If you zoom in on the last image in the report, you see that the victim's client is not a web browser, but Slack's Electron-based client. Perhaps that client is

If you zoom in on the last image in the report, you see that the victim's client is not a web browser, but Slack's Electron-based client. Perhaps that client is willing to send Slack cookies cross-domain after a redirect for an auth'd request? Edit: looks like terom above me had the same idea before I did