DocuSign Lure Targets Tech Exec Credentials

How the Attack Worked

This campaign impersonated DocuSign to target tech executives with document-signing lures. One version used a subject line referencing a document ready for review, prompting recipients to click a Review Document button and later enter a security code on what appeared to be Docusign.com. A second version referenced a specific agreement, such as a share transfer and subscription agreement, and included a pasted-in email thread between multiple companies to appear more legitimate. Both variants ultimately led victims to a fake CAPTCHA and a Gmail or Google Workspace lookalike login page designed to harvest credentials.

Why It Succeeded

The emails were sent from compromised legitimate business email accounts rather than newly registered domains. This helped the messages pass DMARC checks and avoid spam filtering, since the sending infrastructure was technically legitimate even though the content was malicious. The use of a real prior email thread added a layer of social proof, making the request look like a continuation of an existing business conversation rather than a cold, suspicious message. Links were also routed through a legitimate marketing service before reaching the credential-harvesting page, adding another layer of apparent legitimacy to the click path.

What to Watch For

• Unexpected DocuSign requests urging immediate review or signature
• Sender addresses tied to third-party organization mailboxes rather than expected DocuSign notification sources
• Overly long or unusual filenames in subject lines, including multiple file extensions
• Links that route through marketing or redirect services instead of a clear DocuSign domain
• Login pages requesting Gmail or Google Workspace credentials after clicking a document link, especially when paired with a CAPTCHA step

Building Resistance

Defenders and executives should verify any unexpected DocuSign request by logging into DocuSign directly and checking Documents or using the Access Code feature, rather than clicking email links or buttons. Sender addresses should be checked directly rather than trusting the display name shown by an email client, particularly when a message includes what looks like an ongoing conversation thread. Organizations should also flag and treat as suspicious any messages that fail SPF, DKIM, or DMARC checks, and encourage users to report unexpected document-signing requests. Because credentials captured through these pages can be reused for follow-on attacks like business email compromise, quick reporting and verification steps are key to limiting downstream impact.

This pattern reflects known techniques such as spearphishing links, impersonation, and credential harvesting through fake web pages, documented under MITRE ATT&CK references including attack.mitre.org/techniques/T1566/002 and attack.mitre.org/techniques/T1656.

How did the DocuSign phishing emails avoid spam filters?

The campaign was sent from compromised legitimate business email accounts, which helped the messages pass DMARC checks and avoid being flagged as spam.

What happens after clicking the Review Document link?

Victims are routed through a marketing redirect service or a malicious site hosting obfuscated JavaScript, eventually landing on a fake CAPTCHA and a Gmail or Google Workspace lookalike page that captures their credentials.

Why did the emails include an existing email thread?

Attackers pasted in a legitimate-looking thread between multiple companies to make the phishing email appear more credible and trustworthy.

What should stolen DocuSign credentials be used for by attackers?

According to the findings, stolen credentials were intended for follow-on attacks such as business email compromise scams or resale on marketplaces.