Those emails mainly came from the domain’s emailcom and coza. In September, the service revealed a campaign where attackers hid malicious URLs in legitimate DocuSign envelopes. Unlike the attack described above, the emails did not originate from DocuSign. The attackers sent out fake envelopes from addresses. They sent victims to a phishing landing page designed to steal their Office 365 credentials.ĭocuSign itself uncovered a phishing operation in April 2021. The attack used stolen DocuSign branding. But there are plenty of attacks where phishers have faked the service to prey on unsuspecting users.īack in August 2019, for instance, researchers uncovered a campaign targeting users across multiple verticals. The attack described above stands out for its abuse of DocuSign’s platform. With this, they can spoof one of those supported file types to deliver a malware payload. In another method, an attacker could use a steganography attack.

(DocuSign converts other types of uploaded document files into static PDFs to stop attacks.) A signer can then access the link and/or embedded files when they’re given the option to download the file - even if those resources are malicious.

This technique works because PDFs, Word documents and other types of files in DocuSign retain their clickability up through the finished page. They land on a phishing site designed to steal their login credentials for Dropbox, Microsoft and other services. The only difference is that clicking on the link redirects the recipient. The process for signing a document is the same as with a legitimate file. DocuSign’s servers host the phishing link, thus allowing it to successfully land in a recipient’s inbox. The email evades detection because it’s technically clean. It prompts them to review and sign an electronic document by clicking on a hyperlinked ‘View Document’ button. The recipient, in turn, receives an email invitation from DocuSign. Next, the attacker sends a DocuSign envelope to their target. Inside the Phishing Attemptįirst, a malicious actor registers a free account with DocuSign or compromises another user’s account. Attackers are abusing the electronic agreement management company DocuSign to send phishing links and documents.

Dropbox desktop app phishing link