Phishing campaign leverages DocuSign to send malicious documents and phishing links

guest · Aug 16, 2021

Phishing campaign leverages legit DocuSign email notifications
August 13, 2021
https://www.scmagazine.com/analysis...-leverages-legit-docusign-email-notifications

Rather than spoofing DocuSign notifications, phishing scammers are now signing up for free accounts with the cloud-based documenting signature service and compromising the accounts of others as a way to trick email recipients into clicking on malicious links, researchers have reported.

According to a new Avanan blog post, this is a novel tactic, as the company is not aware of any previous phishing campaigns that have abused authentic and legitimate DocuSign accounts. In emailed commentary, researchers at Ironscales disagreed with Avanan's claim that the methodology is new, suggesting they "have seen many of these DocuSign attacks." However, they did assert that it has become "prevalent."

"Using legitimate accounts to deliver phishing is a very common practice and unfortunately, is usually highly effective for cybercriminals," Ironscales said in a statement.
Click to expand...

DocuSign normally converts these documents into static .pdfs, thus preventing the user from mistakenly enabling a malicious macro.

However, these PDF files still have viable hypertext links that, if clicked, could deliver a malicious document or direct a user to a phishing page.

"This is a particularly effective attack because the email itself would be clean. The phishing link itself is hosted on DocuSign’s servers," the company blog post states.
Click to expand...

Avanan: New Attack Sends Phishing Via DocuSign

Avanan researchers have discovered a new attack, whereby hackers can use DocuSign to send malicious documents and phishing links.
Click to expand...

guest · Aug 18, 2021

How to spot a DocuSign phish and what to do about it
August 18, 2021
https://blog.malwarebytes.com/socia...pot-a-docusign-phish-and-what-to-do-about-it/

Phishing scammers love well known brand names, because people trust them, and their email designs are easy to rip off. And the brands phishers like most are the ones you’re expecting to hear from, or wouldn’t be surprised to hear from, like Amazon or DHL. Now you can add DocuSign to that list.

Google searches for DocuSign almost doubled during March 2020, and stayed there, as so many people around the world started working from home.
Earlier this year, DocuSign specifically warned about phishing campaigns using its brand.
Click to expand...

Bad signs to look for
DocuSign phishing emails have many of the tell-tale signs of other phishing attacks: Fake links, fake senders, misspellings, and the like.
Recipients can check links by hovering their mouse pointer over the document link in the email. If it is an actual DocuSign document it will be hosted at docusign.net. In the spam campaigns we have seen, documents were hosted at docs.google.com, feedproxy.google.com, and some documents came as attachments, which DocuSign does not do.

Also, the sender address should belong to docusign.net, but that alone is not enough: We have seen spoofed messages coming from that address, so check for other indicators.
Click to expand...

We’ve included some examples of DocuSign phishing campaigns below.
Click to expand...

guest · Oct 14, 2021

DocuSign phishing campaign targets low-ranking employees
October 14, 2021
https://www.bleepingcomputer.com/ne...shing-campaign-targets-low-ranking-employees/

Phishing actors are following a new trend of targeting non-executive employees but who still have access to valuable areas within an organization.

As reported by Avanan researchers, half of all phishing emails they analyzed in recent months impersonated non-executives, and 77% of them targeted employees on the same level.
Previously, phishing actors would impersonate CEOs and CFOs to trick company employees in targeted phishing attacks.
Click to expand...

However, as the CEOs got more vigilant and security teams in large firms added more safeguards around those “critical” accounts, phishing actors turned to lower ranking employees that can still serve as excellent entry points into corporate networks.

"Security admins might be spending a lot of time providing extra attention to the C-Suite and hackers have adjusted. At the same time, non-executives still hold sensitive information and have access to financial data. Hackers realized, there is no need to go all the way up the food chain." - Avanan
Click to expand...

Phishing passwords with DocuSign
As Avanan details in its report, a typical trick deployed in these campaigns is the involvement of DocuSign, an otherwise legit cloud-based document signing platform.
The actors offer DocuSign as an alternate signing method in the emails they send, and ask the recipients to enter their credentials to view the document and sign it.

In the haste of daily work, it is likely that some employees will be tricked by this message and treat it as a real DocuSign request, entering their email credentials and handing them over to the phishing actors
Click to expand...

Log in or Sign up

Phishing campaign leverages DocuSign to send malicious documents and phishing links

guest Guest

guest Guest

guest Guest

Log in or Sign up

Phishing campaign leverages DocuSign to send malicious documents and phishing links

guest Guest

guest Guest

guest Guest

Useful Searches