Threats Tagged 'docusign'

ScreenConnect is used in phishing URLs to deliver RMM payload. DocuSign has been observed to be the common theme in these phishing emails.

This analysis examines a sophisticated malware delivery chain that begins with a phishing email impersonating DocuSign. The attack employs multiple evasion techniques, including an access-code gate, time-based checks, and packing. The initial payload is a single-file .NET bundle with a valid code signing certificate. Static analysis revealed a second-stage native binary with additional obfuscation. The final payload is identified as Vidar malware. The investigation showcases the effectiveness of combining static and dynamic analysis tools to overcome advanced evasion tactics and reconstruct the full attack chain, from the initial phishing email to the final payload.

MediumMalwareGermanyUnited KingdomFrance+4#phishing#vidar#docusign

During the holiday season, threat actors exploit overloaded inboxes and financial stress through two main patterns: Docusign-themed phishing for corporate credential harvesting and loan offer spam for personal data theft. The Docusign campaign uses spoofed emails with authentic-looking branding, redirecting through disposable hosting platforms to a credential harvesting page. The loan scams range from obvious 'Xmas loan' offers to sophisticated marketing-style emails, ultimately leading victims to a detailed identity theft questionnaire on christmasscheercash.com. Both scams utilize seasonal themes and mimic normal end-of-year workflows to increase effectiveness. Defensive measures include verifying sender domains, validating link destinations, and treating unsolicited loan offers as high risk.

MediumCampaignUnited KingdomGermanyFrance+3#identity theft#phishing#holiday-themed