Alert: New Phishing Campaign Observed, April 7, 2020
DocuSign has observed a new phishing campaign that spoofs DocuSign, suggesting that all contract documents associated with your "COVID-19 AFFIDAVIT for property" is completed. The email is coming from "brome526[@]bdhomes.com" and the URL within is https[:]//realestatesecuredocuments[.]org/2UCloO4. The final landing page is https[:]//realestateproperties.estate/x787xe8ruh22@/inline.php. The subject line is "Re: TK464351 COMPLETED DOCUSIGN : COVID 19 AFFIDAVIT for property" and similiar.
These emails are not sent from DocuSign. Do not click on the link in these emails, instead please forward them to firstname.lastname@example.org and then delete the email immediately.
For more information on how to spot phishing please see our Combating Phishing white paper.