Hackers Exploiting Docusign With Phishing Attack To Steal Credentials

Hackers prefer phishing as it exploits human vulnerabilities rather than technical flaws which make it a highly effective and low-cost attack method. 

Phishing attacks can be easily scaled to target a large number of individuals, increasing the likelihood of success.

Recently, cybersecurity analysts at Abnormal Security discovered that hackers are actively exploiting DocuSign with customizable phishing templates to steal credentials.

Hackers Exploiting Docusign

DocuSign phishing emails targeting customers have spiked, and this mirrors templates found on Russian cybercrime forums. 

These carefully designed fraudulent emails pretend to be legitimate document signing requests from DocuSign but they take advantage of the fact that DocuSign is widely used and trusted. 

Docusign phishing email (Source – Abnormal Security)

Dark web anonymity enables threat actors to trade and tailor DocuSign templates for large-scale phishing, identity theft, and financial fraud. 

Investigations show that there are many marketplaces where these templates are sold while others offer customization services with a promise of exclusivity.

ANYRUN malware sandbox’s 8th Birthday Special Offer: Grab 6 Months of Free Service

The growing number of such templates is indicative of digital fraud techniques that organizations need to be aware of in order to manage them.

For instance, before launching phishing campaigns, threat actors either buy templates from reputable sellers on crime forums or get them directly from the targeted service like DocuSign.

Buying templates is easy but requires good replication besides ensuring that they are exclusive. 

Directly downloading templates can be time-consuming and risky as it may involve manual replication and reveal the identity of a criminal. Many people do not have the technical skills to create realistic-looking templates. 

Phishing products (Source – Abnormal Security)

Running several concurrent campaigns targeting various vendors means one does not have to spend much time creating the resource-intensive templates for every campaign, so, purchasing readymade ones saves time. 

Cybercrime groups tend to streamline their operations in order to maximize their profits by sourcing out large quantities of pre-made templates or outsourcing their creation from third parties.

Some threat actors make money by stealing DocuSign passwords through phishing and then use them to carry out BEC and corporate espionage. 

For example, they can go over the files and find payment information, hack into a company’s account, and request money from partners pretending to be the company. 

Also, they likewise vend critical files such as strategic plans of merging, financials, and lists of customers to outsiders or enter blackmail by using it as bait. 

With this work, these individuals generate huge illegal gains while victim organizations experience economic losses and loss of public image.

Recommendations

Here below we have mentioned all the recommendations:-

  • Check the sender’s email address
  • Watch out for impersonal greetings
  • Verify the security code format
  • Inspect links before clicking
  • Use Docusign’s secure document access

Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers

Tushar Subhra

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

U.S. Secures Extradition of Rydox Cybercrime Marketplace Admins from Kosovo in Major International Operation

The United States has successfully extradited two Kosovo nationals, Ardit Kutleshi, 26, and Jetmir Kutleshi,…

4 hours ago

Ivanti Fully Patched Connect Secure RCE Vulnerability That Actively Exploited in the Wild

Ivanti has issued an urgent security advisory for CVE-2025-22457, a critical vulnerability impacting Ivanti Connect…

2 days ago

Beware! Weaponized Job Recruitment Emails Spreading BeaverTail and Tropidoor Malware

A concerning malware campaign was disclosed by the AhnLab Security Intelligence Center (ASEC), revealing how…

2 days ago

EncryptHub Ransomware Uncovered Through ChatGPT Use and OPSEC Failures

EncryptHub, a rapidly evolving cybercriminal entity, has come under intense scrutiny following revelations of operational…

2 days ago

PoisonSeed Targets CRM and Bulk Email Providers in New Supply Chain Phishing Attack

A sophisticated phishing campaign, dubbed "PoisonSeed," has been identified targeting customer relationship management (CRM) and…

2 days ago

Beware! Fake Unpaid Tolls Messages Used in Phishing Attack to Steal Login Credentials

A surge in phishing text messages claiming unpaid tolls has been linked to a massive…

2 days ago