N0va Threat Actors Target North American and European Firms in Phishing Campaign

LONDON — A cyber threat group identified as N0va has launched a coordinated phishing campaign targeting organizations across North America and Europe, exploiting trusted service impersonation to compromise digital identities. The offensive, detected on September 16, 2026, utilizes sophisticated social engineering tactics designed to bypass standard security controls by abusing legitimate authentication flows.

The attackers are masquerading as reputable third-party services and internal corporate tools to deceive employees into surrendering login credentials. By leveraging valid authentication mechanisms rather than attempting to break encryption or exploit software vulnerabilities, the group gains direct access to user accounts without triggering traditional intrusion alerts. This method allows N0va to move laterally within targeted networks, accessing sensitive data, business systems, and cloud resources.

Victims of the campaign span multiple sectors in the United States, Canada, the United Kingdom, and Western Europe. The primary objective of the operation is to secure persistent access to corporate environments. Once inside, the group aims to exfiltrate proprietary information, disrupt operational continuity, and inflict financial damage. Security analysts note that the compromise of valid credentials also creates significant compliance risks for affected entities, potentially violating data protection regulations in both regions.

The campaign represents a shift in tactics for the N0va group, which has historically relied on more direct exploitation methods. By focusing on the human element and legitimate access pathways, the attackers are able to maintain a lower profile while achieving high-value objectives. The scope of the attacks suggests a well-resourced operation capable of tailoring lures to specific industries and organizational structures.

Organizations in the targeted regions are advised to review authentication logs for anomalies and reinforce multi-factor authentication protocols. Despite the sophistication of the campaign, no single point of failure has been identified that would allow for an immediate global shutdown of the attack infrastructure. The group's ability to rotate domains and mimic trusted services complicates mitigation efforts.

Questions remain regarding the full extent of the data already compromised and whether the group is operating independently or in coordination with other criminal syndicates. As investigations continue, cybersecurity firms are monitoring for new variations of the phishing lures and updated indicators of compromise. The duration of the campaign is unknown, and experts warn that the threat may persist as long as valid credentials remain active within targeted systems.