NovaCookies: $320 a month buys a session-theft rig that rides real Docusign mail

The Docusign leg of this chain is not a spoof, which is why it works. Island says the notification is a genuine Docusign envelope, so sender-authentication and reputation checks have nothing to fail on, and what is malicious is the document shared through the service ^[9]. In the case Island describes, the notice claimed an accounting department had shared a remittance-advice PDF, and the malicious destination sat inside the document, below the layer most mail security products inspect ^[10]. A gateway can grade the sender, the domain and the envelope, be right about all three, and still pass the message.

The second hop does the same thing to identity telemetry, using an OAuth error-redirect technique Microsoft documented in March ^[11]. The third hop is the one that has to survive automation, and it is built for it: a Cloudflare gate and a check for execution traces associated with debugging tools before the fake Microsoft 365 form is served ^[12], plus what Island calls short-lived context binding and runtime inspection ^[13]. The scanner and the employee are not shown the same page. Island's own framing is that each hop looks legitimate alone, the pieces land in different tools, and the browser is where they become one event ^[24].

Now the money. Annualised, the monthly subscription is $3,840 ^[25], which buys what Gritzman calls a maintained sign-in flow, infrastructure rotation and an operator interface, work he notes normally requires a specialist to build and keep running ^[19]. The two-week option costs about $14.29 a day against $10.67 on the monthly plan, roughly a third more per day ^[26], which is how trials get priced when the seller expects conversion. Telegram carries the advertising and also the management plane: customer profiles, redirect configuration and support ^[16].

The infrastructure count says where the operator's friction is. At least 755 domains sit in the dedicated infrastructure ^[6] against hundreds of target organisations ^[4], more than half of them in the US or tied to US entities ^[5], meaning the seller burns domains faster than it lands victims ^[27]. Lure domains cluster on .vu with alternating-case paths such as PwPt-sHaRe and Ms36-AcCeSs ^[17]. Blocklisting that is a treadmill, not a control.

What is left is detection after the fact, and Gritzman says the initial authentication can succeed normally, without malware, an exploit or a burst of failed logins, so the sign-in event may look ordinary ^[18]. Material Security's Abhishek Agrawal reads the pivot to session cookies as an answer to passkeys and WebAuthn making credential theft harder ^[22]. One caveat on the source: Island makes enterprise browsers ^[23]. The observation about hops converging in the browser holds on its own, but the diagnosis and the product line coincide.