Skip to main content
Trust Center

Alert: New Phishing Campaigns Observed

05/13/2020

DocuSign has observed several new phishing campaigns that spoof DocuSign and are COVID-themed. Details for each are below.

  1. The email sender appears as "DocuSign" from suspended[@]sign-doc.com, and indicates in the body that your 'docusign account is temporarily suspended.' The subject line is similar to "Your Docusign account is suspended" The emails contain a link to a malicious URL [http]://covid19.protected-forms[.]com/XYWNb0aW9uPWqNsaWNrJnfVybD1odddHRwhczovL3NlvY3uVyZWQtbG9naW4ubmV0bL3BhZ2VzL2E0ZGFlYzk1OTVlMSZyZWNpcGllbnRfaWQ9NjE5NTkyMTg5JmNhbXBhaWduX3J1bl9pZD0zMTQ3MDEw
    that leads to [https]://secured-login[.]net/pages/a4daec9595e1/XYWNb0aW9uPWqNsaWNrJnfVybD1odddHRwhczovL3NlvY3uVyZWQtbG9naW4ubmV0bL3BhZ2VzL2E0ZGFlYzk1OTVlMSZyZWNpcGllbnRfaWQ9NjE5NTkyMTg5JmNhbXBhaWduX3J1bl9pZD0zMTQ3MDEw. 

  2. The sender again appears as "DocuSign" from carmen.schultz[@]t-online.de. The subject line is similar to "Notification: You have received a document." The email body suggests that the World Health Organization has sent you a document: "COVID-19 impact, situation updates, and policy responses." A malicious URL
    [https]://storage[.]googleapis[.]com/worldhealthorganization/index[.]html
    takes you to
    [https]://virtualmallglobal[.]com/documents/login[.]html. 

  3. The email sender appears as "Rebecca Campbell" from jogina[@]randallmorris.com. The subject line is similar to "Completed: Docusign_FinalApproval/Clear to Close the property/Covid-19 Affidavit." This malicious URL [https]://bit[.]ly/39jkv28
    takes you to
    [https]://realestateescrowdocument[.]estate/x787xe8ruh22@/8af0a1fdf1fb6005665d2bc4d5fa7c77/2816dde2b84c88df5e1cd134bf15c431/login[.]php?cmd=login_submit&id=f8b98db5e70b2e47bf110c6e8e9fef69f8b98db5e70b2e47bf110c6e8e9fef69&session=f8b98db5e70b2e47bf110c6e8e9fef69f8b98db5e70b2e47bf110c6e8e9fef69. 

  4. The email sender appears as "DocuSign via Jimenez: from kjimenez[@]lindsey.com. The body of the email includes the contact Jimenez[@]Keystonetitle.com, claiming that your close time is curbside and scheduled for "1:30pm on 5/013/20." The subject line is similar to "RE: REG 2440 COVID-19 Affidavit and ALTA SETTLEMENT ID no: 244053 , pls sign Thanks." The malicious URL [https]://bit[.]ly/3afxh33
    sends you to
    [https]://generalbamrealtors[.]com/x787xe8ruh22@/ac8120f50c6ca29c78fbd84cde5ab7d5/28428aa5229cf9c9c1ba35239609aa0e/login.php?cmd=login_submit&id=76be3a836e56c3ea7cc3b9e97e04eb1176be3a836e56c3ea7cc3b9e97e04eb11&session=76be3a836e56c3ea7cc3b9e97e04eb1176be3a836e56c3ea7cc3b9e97e04eb11. 

  5. The email sender appears as "DocuSign via Maureen Wilkinson" from nrakosy6468720[@]springhillres.com. The subject line is similar to "FWD:2668502 Please DocuSign this document: Change_to_Listing_COFIC-19_2_1211.pdf." The malicious URL [http]://waiting[.]website/3akIIpr 
    leads you to
    [https]://realestatesproperties[.]estate/x787xe8ruh22@/6baadc89159617043965f9e1889224e7/099043c11c86f05f70d165635ea65814/login.php?cmd=login_submit&id=f1d4c1bb89f4af812573622f86d4485ff1d4c1bb89f4af812573622f86d4485f&session=f1d4c1bb89f4af812573622f86d4485ff1d4c1bb89f4af812573622f86d4485f.

These emails are not sent from DocuSign. Do not click on the links in these emails, instead, please forward them to spam@docusign.com and then delete these emails immediately. 

For more information on how to spot phishing, please see our Combating Phishing white paper.