The Growing Threat of Docusign Phishing Attacks

Cado Security Labs identified a Docusign spearphishing campaign targeting tech executives that uses compromised Japanese business emails and malicious links to redirect victims to credential-stealing websites. The attackers use obfuscated JavaScript to create fake login pages mimicking legitimate Docusign interfaces, with the goal of stealing credentials for use in further attacks such as business email compromise (BEC) scams. Japanese email domains were likely chosen because they have higher reputation scores and are less likely to be flagged by spam filters.