Cybercriminals impersonate the trusted e-signature model and ship faux Docusign notifications to trick individuals into freely giving their private or company knowledge
27 Might 2025
•
,
5 min. learn
Bear in mind if you used to should print, signal, scan, e mail and/and even fax each time you wished to signal and ship an official doc? Right now, a lot of the arduous work is finished behind the scenes by cloud app suppliers like Docusign.
However like all tech manufacturers, as soon as it has reached a crucial mass of customers, cybercriminals will search for methods to abuse it for their very own ends. Docusign claims to have 1.6 million clients all over the world, together with 95% of the Fortune 500, and over one billion customers. That has put it firmly within the crosshairs of menace actors. Learn on to know how one can hold your staff secure from Docusign-themed phishing.
How does Docusign phishing work?
Social engineering is likely one of the largest threats to your small business. In response to Verizon, phishing is now an preliminary entry vector for 19% of knowledge breaches, whereas a whopping 60% characteristic a “human ingredient.” As a trusted and widely known model, Docusign is a pure alternative for menace actors trying to harvest company logins and doubtlessly monetize assaults in different methods.
Victims will usually obtain an e mail with a spoofed Docusign “envelope” requesting that they click on on a big yellow field to “evaluate doc.” There might also be an attachment that includes a QR code. Each actions may result in the identical end result: the sufferer is taken to a phishing web site equivalent to a faux Microsoft login web page, and requested to enter private and/or monetary data.
QR codes are additionally common as they require the person to scan with their cellular machine, which can not have safety software program put in to forestall them from being taken to a malicious web page. Both method, a focused phishing assault like this might additionally allow menace actors to realize a vital foothold in company networks, in addition to for privilege escalation, lateral motion and knowledge exfiltration/ransomware.
Some examples
Over the previous few months, incidents have emerged of:
- “Reputable” Docusign envelopes that spoof invoices from suppliers, in a bid to trick firms into transferring cash.
- Faux bill scams impersonating US state and municipal companies and designed to trick suppliers into wiring cash.
- Cybercriminals are usually not spoofing faux Docusign emails, however as an alternative registering actual accounts with the corporate, and utilizing its APIs to ship out official envelopes spoofing common manufacturers.
- Common phishing emails spoofing the Docusign model and taking the person to phishing login pages. These may mimic company HR and payroll departments, and even exterior entities like municipal authorities.
- Refund scams which cite a faux transaction and attempt to drive the sufferer into calling a quantity in the event that they wish to cancel it. As soon as on the cellphone, they’ll be persuaded handy over their private/monetary/card particulars to say the ‘refund’.
Instance of a rip-off abusing individuals’s belief in Docusign for knowledge theft (Supply: Reddit)
Staying secure
Happily, there’s a lot you are able to do to maintain your self and your organization secure from Docusign threats. From an organization’s perspective, the primary plan of action is to pay attention to the dangers and replace your phishing consciousness packages to make sure workers are in a position to spot the warning indicators of a rip-off e mail. Simulation instruments must be customizable sufficient to assist this.
Issues staff must be taught to look out for embody:
- Vacation spot URLs: hover over any hyperlinks/buttons in Docusign emails to test the vacation spot URLs are official.
- Safety codes: these ought to characteristic on any official Docusign e mail (within the “alternate register technique” part) and permit the person to entry a doc instantly on the Docusign web site relatively than comply with hyperlinks in an e mail.
- Attachments: there must be no attachments in an preliminary Docusign e mail. Solely as soon as a doc has been signed will you obtain a completed model of it through attachment.
- Spelling, grammatical and tonal errors: are one other tell-tale signal of a phishing e mail.
- An e mail signature and sender identify/e mail deal with that don’t match.
Layer up defenses on prime of the safety consciousness piece by together with issues like:
- Multi-factor authentication (MFA) for all company accounts, which can make it tougher for hackers to entry your knowledge, even when they do handle to steal your logins.
- Password hygiene, together with use of robust, distinctive passwords for every account, saved in a password supervisor.
- A multi-layered safety device from a good vendor like ESET, which, amongst different issues, detects malicious attachments, prevents customers from following hyperlinks to phishing websites, and allows directors to manually outline e mail filtering circumstances and actions.
- Up to date coverage to induce customers to not open attachments or comply with hyperlinks in any unsolicited emails, and solely entry Docusign docs through the safety code.
- Altering inside enterprise processes concerning fund transfers, in order that any giant sums are topic to additional scrutiny.
- Encouraging customers to report all suspicious Docusign-themed emails to your IT/safety workforce and to spam@docusign.com.
What to do if you happen to fall sufferer
If the worst occurs and an worker does click on via on a Docusign rip-off, you as an admin might want to work via a particular set of actions, together with:
- Reset passwords for the impacted person, together with any accounts that they could have reused credentials throughout
- Run a malware scan on the sufferer’s machine to detect and take away any malicious code
- Isolate the machine from the community to comprise the “blast radius” of an assault
- Monitor the darkish net for indicators of knowledge theft/leakage
- Monitor the sufferer’s accounts for uncommon exercise
- Dig deeper with forensics to know what the attacker wished and whether or not they managed to realize elevated inside entry
- Use the occasion as a studying second for workers: encouraging them to report suspicious emails quickly and to be on their guard usually about unsolicited emails
In fact, Docusign isn’t simply utilized by companies. You may need been uncovered to it in a private capability when shopping for a home or finishing tax paperwork. In that case, most of the suggestions above will nonetheless stand you in good stead. Digital signing apps are an ideal time-saver. However ensure you don’t get caught out by scammers exploiting your belief in these apps.
