Fake DocuSign Flow Tricks Users Into RMM Installs

How the attack worked

This campaign starts with a phishing page designed to look like a DocuSign document ready for review. Victims are told to click an "Open in Acrobat" style button, which loads a convincing fake viewer complete with a progress bar, document preview, and navigation panel. Before the download button activates, victims must pass a Cloudflare Turnstile verification check. This step adds a layer of legitimacy and also helps the attackers filter out automated security scanners from real targets.

Once verification passes, the victim is offered a download. Rather than delivering traditional malware, the file installs legitimate remote monitoring and management (RMM) software such as MeshAgent, ScreenConnect, SimpleHelp, or Zoho ManageEngine UEMSAgent. The campaign has shifted delivery methods over time, initially using a Visual Basic Script installer before moving to ScreenConnect installers hosted on Dropbox.

Why it succeeded

The workflow succeeds because it closely imitates a routine business process: signing or reviewing a document through DocuSign. Each stage, from the loading screen to the verification check, reinforces a sense of legitimacy. By delivering real administrative tools instead of custom malware, the attackers gain a major advantage: security teams that watch for known malicious files may overlook RMM software that IT departments already use for support and management tasks.

The kit also uses user-agent filtering and staged validation checks, which suggests the operators are deliberately screening out researchers and automated tools while focusing on genuine victims. Telemetry such as IP addresses, browser details, and filenames is reportedly sent to the attackers through the Telegram Bot API once a victim reaches the download stage.

What to watch for

• A "DocuSign" page that asks you to download or run software just to view a document
• Unexpected verification steps, like a Turnstile challenge, tied to a document workflow
• Installer scripts that request User Account Control (UAC) elevation or admin approval
• Downloads hosted on consumer file-sharing services rather than official document platforms
• Unapproved RMM or remote access software appearing on a device

Building resistance

Organizations can reduce risk from this type of attack by training employees to verify unexpected e-signature requests through a separate, trusted communication channel before downloading anything. IT and security teams should also monitor for RMM installations that were not requested or approved, since legitimate tools can still be misused for persistent access. Detection should extend beyond known malware signatures to include suspicious scripting behavior, such as wscript.exe launching PowerShell or attempts to disable Microsoft Defender, since these actions often accompany this kind of installation.

What is the fake DocuSign phishing attack?

It is a phishing workflow that mimics a DocuSign document viewing experience, complete with a fake Adobe Acrobat style interface, to convince victims to download software that turns out to be legitimate remote monitoring and management (RMM) tools.

Why is this attack hard to detect?

Because it installs legitimate IT administration tools such as MeshAgent, ScreenConnect, SimpleHelp, and Zoho ManageEngine UEMSAgent instead of traditional malware, allowing the activity to blend into normal IT operations.

What are the warning signs of this scam?

Red flags include a document workflow that asks you to download or run software, an unusual verification step like Cloudflare Turnstile before a download, and installer scripts that request admin or UAC elevation.

How can organizations defend against this technique?

Train employees to verify unexpected e-signature requests through a trusted channel, monitor for unapproved RMM installs, and detect suspicious scripting activity such as attempts to disable Microsoft Defender.