Last week, our team received four separate DocuSign agreements via email. At first glance, they looked suspicious, but not for the reasons you might think.
Upon review, the messages were not blocked by our security system. They appeared to come from real DocuSign accounts. And that’s exactly what made them dangerous.
Welcome to the newest evolution of phishing attacks, where hackers are now using legitimate DocuSign accounts to launch malware-laced requests for signatures. It’s no longer about spoofing a lookalike email or domain. This is about weaponizing trust in real business tools to sidestep your defenses.
Legitimate Senders, Malicious Payloads
These phishing emails weren’t caught by our filters for one reason: they were real DocuSign links, sent through DocuSign’s actual platform and they are by nature encrypted. No spoofing. No impersonation headers. No red flags at the DNS level.
Inside the documents? Encrypted malware and links to remote code execution tools. Because DocuSign encrypts every attachment and link in transit, most email gateways and endpoint detection systems can’t inspect encrypted contents. Once the recipient clicks the “Review Document” button, they’re taken to a seemingly legitimate signing page, sometimes with their name or company pre-filled.
It’s social engineering disguised as business continuity.
Why These Attacks Are So Effective
The key to this strategy’s success lies in one word: legitimacy. These emails don’t raise alarms because:
- They come from real DocuSign addresses.
- They pass SPF, DKIM, and DMARC checks.
- The links point to actual DocuSign domains.
- Everything appears encrypted, clean, and business-relevant.
To most users, and even to many automated security tools, these messages look completely normal. The only red flag? The person or company requesting the signature is unfamiliar, and/or the document content is unclear.
By the time someone realizes something is off, it may already be too late.
What Businesses Can Do About It
This is a difficult threat to combat with technology alone. Because the attack uses a legitimate platform, it bypasses most perimeter defenses. But that doesn’t mean you’re powerless. Here’s how you can respond:
- Train for Context, Not Just Content Security awareness training must now emphasize situational judgment: questioning why you received a DocuSign and who it’s from, not just looking for typos or broken links.
- Use Advanced Threat Protection Tools Some platforms, like Sophos with email header analysis, can flag behavioral anomalies or detect encrypted payloads at rest, though even these systems can be circumvented in edge cases.
- Require Internal Verification of Signature Requests Encourage employees to verify any signature request, even from vendors, using a second channel like a direct call or internal message.
- Consider Vendor Whitelisting and Isolation Limit who can send documents for signing to known, approved vendors. Alternatively, isolate signing portals in secure browser environments.
- Stay Updated on New Tactics Threat actors evolve. If your IT provider isn’t informing you of new attack vectors like this one, it’s time to rethink your cybersecurity partnership.
Your Partner in Proactive Cyber Defense
At smplsolutions, we go beyond reactive protection. Our cybersecurity stack combines 24/7 monitoring, user awareness training, and emerging threat intelligence to stay one step ahead of modern attacks.
If you’re using tools like DocuSign or Adobe Sign, now is the time to reassess how secure your processes really are. The appearance of legitimacy is no longer enough.
Let us help you build defenses that go deeper than surface-level detection.