Alert: New Phishing Campaigns Observed

DocuSign has observed several new phishing campaigns that spoof DocuSign and are COVID-themed. Details for each are below.

  1. The email sender appears as "DocuSign" from suspended[@], and indicates in the body that your 'docusign account is temporarily suspended.' The subject line is similar to "Your Docusign account is suspended" The emails contain a link to a malicious URL [http]://covid19.protected-forms[.]com/XYWNb0aW9uPWqNsaWNrJnfVybD1odddHRwhczov
    that leads to [https]://secured-login[.]net/pages/a4daec9595e1/XYWNb0aW9uPWqNsaWNrJnfVybD1odddHRwh
  2. The sender again appears as "DocuSign" from carmen.schultz[@] The subject line is similar to "Notification: You have received a document." The email body suggests that the World Health Organization has sent you a document: "COVID-19 impact, situation updates, and policy responses." A malicious URL [https]://storage[.]googleapis[.]com/worldhealthorganization/index[.]html
    takes you to
  3. The email sender appears as "Rebecca Campbell" from jogina[@] The subject line is similar to "Completed: Docusign_FinalApproval/Clear to Close the property/Covid-19 Affidavit." This malicious URL [https]://bit[.]ly/39jkv28
    takes you to
  4. The email sender appears as "DocuSign via Jimenez: from kjimenez[@] The body of the email includes the contact Jimenez[@], claiming that your close time is curbside and scheduled for "1:30pm on 5/013/20." The subject line is similar to "RE: REG 2440 COVID-19 Affidavit and ALTA SETTLEMENT ID no: 244053 , pls sign Thanks." The malicious URL [https]://bit[.]ly/3afxh33
    sends you to
  5. The email sender appears as "DocuSign via Maureen Wilkinson" from nrakosy6468720[@] The subject line is similar to "FWD:2668502 Please DocuSign this document: Change_to_Listing_COFIC-19_2_1211.pdf." The malicious URL [http]://waiting[.]website/3akIIpr 
    leads you to

These emails are not sent from DocuSign. Do not click on the links in these emails, instead, please forward them to and then delete these emails immediately. 

For more information on how to spot phishing, please see our Combating Phishing white paper.