The email is a real Docusign notification. It opens a real Docusign envelope, in the real viewer. The document inside is the counterfeit, and the link buried in it leads to a phishing service that rents for $320 a month and walks away with your Microsoft 365 session.
Shachar Gritzman, a senior security researcher at Island, published a study of the service, which its operator panel brands NovaCookies, on 26 August 2026. Island's review found hundreds of organizations targeted across several regions, and its companion release lists 755 domains assessed as dedicated attacker infrastructure. It was also picked up in SentinelOne's weekly roundup.
Phishing sold the way software is sold
An account advertising NovaCookies quoted $320 a month or $200 for fourteen days, with domains, hosting and Microsoft or Google branded redirect options included. Island is careful about what that proves: it found no order or payment confirming the seller's claims about customers, though both advertised redirect variants turn up in observed campaign infrastructure.
The commercial model is why a defender should care. A run of apparently unrelated phishing incidents can be several buyers renting one product, so blocking yesterday's domain leaves the operation intact. Island's data shows low-volume infrastructure in late 2025 and a sharp expansion from mid-May 2026, with nearly nine in ten identified organizations tied to lures on .vu domains.
Every hop in the chain looks reasonable
Because the Docusign notification is genuine, it passes normal sender-authentication and reputation checks. The counterfeit share notice, claiming an accounting department shared a remittance-advice PDF, sits inside the envelope, below the layer most mail security products inspect.
Some chains then used an OAuth error-redirect technique that Microsoft documented in March 2026. An application registered in an attacker-controlled tenant carries a redirect URI pointing at attacker infrastructure, and a genuine Microsoft authorization URL is built to fail silent authentication, so Entra sends the browser from its own domain to that pre-registered hop. No token is issued and no consent prompt appears. Island states plainly that neither Docusign nor Microsoft was compromised; both were used as delivery layers.
The lure domains borrow recognizable company names and mutate them, with published examples including fordmotbvmorcompany[.]vu and morganstbftanley[.]vu, and paths opening with alternating-case labels such as PwPt-sHaRe. Island cautions that a borrowed brand is not evidence the named company was compromised or even targeted.
Approving the push notification is the trap
NovaCookies is an adversary-in-the-middle relay: it sits between the victim and Microsoft and passes the login through in real time. The victim completes a genuine authentication, password and multi-factor step included, and the service captures the session cookie Microsoft issues. Island found the kit carries dedicated handling for authenticator push approval, authenticator one-time codes and SMS codes, using Microsoft's own internal names for those methods. A relay written against a generic login form would not mirror Entra's method taxonomy.
That is why one-time codes and push prompts are not a fix here, the same point our coverage of fake browser pop-ups that steal MFA logins landed on, and why Cisco Talos found phishing now starts most intrusions. The kit also resists study, with buyer-configurable browser checks, client-side proof of work and debugger-timing checks. Island calls it scanner-resistant rather than scanner-proof.
Put passkeys on the accounts that matter
Island's structural recommendation is phishing-resistant authentication on high-value accounts: a passkey or FIDO2 security key is bound to the real origin and will not authenticate to a relay. Alongside that: correlate the .vu lure shape, brand-mutated hostnames and mixed-case document-action tokens rather than chasing single domains; inspect links inside document viewers; and treat any completed relay as possible session theft, revoking sessions and reviewing new MFA methods and OAuth grants.
Island's warning about its own indicator list is the useful one. The domains expire. The service does not.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.