Phishing

Hackers Exploiting Docusign With Phishing Attack To Steal Credentials

Hackers prefer phishing as it exploits human vulnerabilities rather than technical flaws which make it a highly effective and low-cost attack method. 

Phishing attacks can be easily scaled to target a large number of individuals, increasing the likelihood of success.

Recently, cybersecurity analysts at Abnormal Security discovered that hackers are actively exploiting DocuSign with customizable phishing templates to steal credentials.

Hackers Exploiting Docusign

DocuSign phishing emails targeting customers have spiked, and this mirrors templates found on Russian cybercrime forums. 

These carefully designed fraudulent emails pretend to be legitimate document signing requests from DocuSign but they take advantage of the fact that DocuSign is widely used and trusted. 

Docusign phishing email (Source – Abnormal Security)

Dark web anonymity enables threat actors to trade and tailor DocuSign templates for large-scale phishing, identity theft, and financial fraud. 

Investigations show that there are many marketplaces where these templates are sold while others offer customization services with a promise of exclusivity.

ANYRUN malware sandbox’s 8th Birthday Special Offer: Grab 6 Months of Free Service

The growing number of such templates is indicative of digital fraud techniques that organizations need to be aware of in order to manage them.

For instance, before launching phishing campaigns, threat actors either buy templates from reputable sellers on crime forums or get them directly from the targeted service like DocuSign.

Buying templates is easy but requires good replication besides ensuring that they are exclusive. 

Directly downloading templates can be time-consuming and risky as it may involve manual replication and reveal the identity of a criminal. Many people do not have the technical skills to create realistic-looking templates. 

Phishing products (Source – Abnormal Security)

Running several concurrent campaigns targeting various vendors means one does not have to spend much time creating the resource-intensive templates for every campaign, so, purchasing readymade ones saves time. 

Cybercrime groups tend to streamline their operations in order to maximize their profits by sourcing out large quantities of pre-made templates or outsourcing their creation from third parties.

Some threat actors make money by stealing DocuSign passwords through phishing and then use them to carry out BEC and corporate espionage. 

For example, they can go over the files and find payment information, hack into a company’s account, and request money from partners pretending to be the company. 

Also, they likewise vend critical files such as strategic plans of merging, financials, and lists of customers to outsiders or enter blackmail by using it as bait. 

With this work, these individuals generate huge illegal gains while victim organizations experience economic losses and loss of public image.

Recommendations

Here below we have mentioned all the recommendations:-

  • Check the sender’s email address
  • Watch out for impersonal greetings
  • Verify the security code format
  • Inspect links before clicking
  • Use Docusign’s secure document access

Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers

Tushar Subhra Dutta

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these systems to steal sensitive data, interrupt…

2 days ago

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a threat actor to read sensitive files…

2 days ago

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes. Resecurity researchers have recently revealed that…

2 days ago

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million Ecuadorian citizens. The announcement was made…

3 days ago

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery efforts following a recent cybersecurity breach.…

3 days ago

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection for Amazon Simple Storage Service (Amazon…

3 days ago