This threat involves a sophisticated phishing operation leveraging DocuSign-themed lures to deliver legitimate remote management software (MeshAgent, ScreenConnect, SimpleHelp) to victims. The attackers use a modular web kit that stages payload delivery through simulated document loading interfaces and filters targets based on user-agent strings to focus on Windows systems while blocking Microsoft Edge browsers. Cloudflare Turnstile is used for bot mitigation. The campaign supports both Windows and macOS delivery paths and employs VBS deployment scripts that disable Windows Defender and install services to maintain persistence. Real-time victim telemetry is sent via Telegram. The infrastructure is actively rotated across multiple domains with consistent URL patterns to avoid detection. The campaign abuses trusted IT management tools for persistent access and has been active from May through July 2026.

Victims may be tricked into installing legitimate remote management software that is abused by attackers to maintain persistent access to compromised systems. The campaign disables Windows Defender, which reduces endpoint protection effectiveness, and establishes persistence via service installation. The use of trusted IT tools complicates detection and response. Both Windows and macOS systems are targeted, increasing the potential victim pool. The infrastructure rotation and use of Cloudflare Turnstile make detection and blocking more difficult.

No official patch or fix is applicable as this is a phishing and malware delivery campaign rather than a software vulnerability. Defenders should focus on user awareness training to recognize phishing lures, especially those impersonating DocuSign. Network and endpoint detection should monitor for installation and execution of MeshAgent, ScreenConnect, SimpleHelp, and suspicious VBS scripts disabling Windows Defender or installing services. Blocking known malicious domains and URLs associated with this campaign can help reduce exposure. Since the campaign uses Cloudflare Turnstile and rotates domains, continuous threat intelligence updates are recommended. There is no vendor-managed remediation as this is not a cloud service vulnerability.