{"id":74198,"date":"2017-06-01T14:23:45","date_gmt":"2017-06-01T21:23:45","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=74198"},"modified":"2025-06-02T20:50:12","modified_gmt":"2025-06-03T03:50:12","slug":"misuse-of-docusign-email-addresses-leads-to-phishing-campaign","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/","title":{"rendered":"Misuse of DocuSign Email Addresses Leads to Phishing Campaign"},"content":{"rendered":"<p><a href=\"https:\/\/trust.docusign.com\/\">DocuSign<\/a>, which provides electronic signatures and digital transaction management, reported that email addresses were stolen by an unknown party on May 15. Although the company confirmed that no personal information was shared, <a href=\"https:\/\/trust.docusign.com\/en-us\/personal-safeguards\/\">DocuSign has reported<\/a>\u00a0that a malicious third party gained temporary access to a separate, non-core system that allows it to communicate service-related announcements to users via email. This incident has left a lot of DocuSign individual users and business professionals vulnerable, because the attacker group is trying to exploit the users through phishing emails. Users are receiving mails on their corporate email\u00a0IDs, in which they are asked to review and sign job-related documents such as accounting invoices, by clicking on the \u201cReview Document\u201d hyperlink in the malicious documents.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-74208 aligncenter\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/05\/spam_docusign-225x300.png\" alt=\"\" width=\"281\" height=\"375\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/spam_docusign-225x300.png 225w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/spam_docusign-374x500.png 374w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/spam_docusign.png 384w\" sizes=\"auto, (max-width: 281px) 100vw, 281px\" \/><\/p>\n<p style=\"text-align: center;\"><em>Spam email.<\/em><\/p>\n<p>The phishing link downloads a document file consisting of malicious code, which when opened injects malware in the system&#8217;s process svchost.exe.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-74210 aligncenter\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/05\/injected_docusign-300x63.png\" alt=\"\" width=\"376\" height=\"79\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/injected_docusign-300x63.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/injected_docusign.png 417w\" sizes=\"auto, (max-width: 376px) 100vw, 376px\" \/><\/p>\n<p style=\"text-align: center;\"><em>Process injection.<\/em><\/p>\n<p>The injected process sends a request to the following URLs:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-74209 aligncenter\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/05\/Data_send_docusign-300x135.png\" alt=\"\" width=\"447\" height=\"201\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/Data_send_docusign-300x135.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/Data_send_docusign.png 629w\" sizes=\"auto, (max-width: 447px) 100vw, 447px\" \/><\/p>\n<p style=\"text-align: center;\"><em>Contacting the remote host.<\/em><\/p>\n<p>The malware receives the response:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-74211 aligncenter\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/05\/response_docusign-300x31.png\" alt=\"\" width=\"465\" height=\"48\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/response_docusign-300x31.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/response_docusign.png 598w\" sizes=\"auto, (max-width: 465px) 100vw, 465px\" \/><\/p>\n<p style=\"text-align: center;\"><em>Response from server.<\/em><\/p>\n<p>The response is an encrypted file that could be any of three types:<\/p>\n<ul>\n<li>DLL: The common password stealer Pony Loader, aka Fareit.<\/li>\n<li>EXE: A similar variant known as Evil Pony.<\/li>\n<li>EXE ZLoader: For loading exploit kits and other malware.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-74201 aligncenter\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/05\/Downloaded_stealer_doc-300x41.png\" alt=\"\" width=\"483\" height=\"66\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/Downloaded_stealer_doc-300x41.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/Downloaded_stealer_doc.png 538w\" sizes=\"auto, (max-width: 483px) 100vw, 483px\" \/><\/p>\n<p style=\"text-align: center;\"><em>The compressed and encrypted\u00a0stealer component.<\/em><\/p>\n<p>The files are aplib compressed and XOR encrypted. The download has to first be decompressed and then decrypted. The first 8 bytes of the file are the XOR key.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-74200 aligncenter\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/05\/Downloaded_stealer_after_decrypt_doc-300x51.png\" alt=\"\" width=\"487\" height=\"83\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/Downloaded_stealer_after_decrypt_doc-300x51.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/Downloaded_stealer_after_decrypt_doc.png 545w\" sizes=\"auto, (max-width: 487px) 100vw, 487px\" \/><\/p>\n<p style=\"text-align: center;\"><em>The decrypted\u00a0stealer component.<\/em><\/p>\n<p>The DLL file uses a lot of anti-debugging techniques to avoid analysis. It also creates a mutex to avoid its own multiple instances running on the same machine.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-74203 aligncenter\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/05\/Mutex_pony_doc-300x14.png\" alt=\"\" width=\"450\" height=\"21\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/Mutex_pony_doc-300x14.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/Mutex_pony_doc.png 520w\" sizes=\"auto, (max-width: 450px) 100vw, 450px\" \/><\/p>\n<p style=\"text-align: center;\"><em>Creating the mutex.<\/em><\/p>\n<p>The DLL, Pony Loader, steals the username, password, and other information. The following screenshots show code for stealing user credentials from\u00a0Chrome and Outlook.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-74199 aligncenter\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/05\/ChromSteal-300x61.png\" alt=\"\" width=\"525\" height=\"107\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/ChromSteal-300x61.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/ChromSteal.png 740w\" sizes=\"auto, (max-width: 525px) 100vw, 525px\" \/><\/p>\n<p style=\"text-align: center;\"><em>Code for stealing Chrome credentials.<\/em><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-74204 aligncenter\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/05\/Other_pwd_steal_doc-300x145.png\" alt=\"\" width=\"523\" height=\"253\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/Other_pwd_steal_doc-300x145.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/Other_pwd_steal_doc-768x371.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/Other_pwd_steal_doc-1024x495.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/Other_pwd_steal_doc-1035x500.png 1035w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/Other_pwd_steal_doc.png 1097w\" sizes=\"auto, (max-width: 523px) 100vw, 523px\" \/><\/p>\n<p style=\"text-align: center;\"><em>Code for stealing Outlook\u00a0credentials.<\/em><\/p>\n<p>The EXE, Evil Pony, steals credentials from FileZilla:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-74202 aligncenter\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/05\/FileZilla_Steal_doc-300x165.png\" alt=\"\" width=\"525\" height=\"289\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/FileZilla_Steal_doc-300x165.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/FileZilla_Steal_doc-768x422.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/FileZilla_Steal_doc-1024x563.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/FileZilla_Steal_doc-909x500.png 909w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/FileZilla_Steal_doc.png 1038w\" sizes=\"auto, (max-width: 525px) 100vw, 525px\" \/><\/p>\n<p style=\"text-align: center;\"><em>Code for stealing FileZilla\u00a0credentials.<\/em><\/p>\n<p>Once downloaded, these malware monitor a user\u2019s keystrokes, capture personal information such as usernames and passwords, and send this information to the malware originator.<\/p>\n<p><a href=\"https:\/\/trust.docusign.com\/static\/downloads\/DocuSign%20IOC%20Ref%20Materials_05162017.pdf\">DocuSign has reported<\/a> that they have taken quick measures to block the unauthorized access and have added further security to their systems. The company has also advised its users to keep their antimalware software updated.<\/p>\n<p>McAfee urges all customers to ensure McAfee\u2019s DAT updates have been applied to ensure the latest protection. We advise customers to be diligent in applying security updates for all the software they use.<\/p>\n<h2>SHA256 hashes of the analyzed samples:<\/h2>\n<ul>\n<li>fff786ec23e6385e1d4f06dcf6859cc2ce0a32cee46d8f2a0c8fd780b3ecf89a:\u00a0W97M\/Dropper.cu<\/li>\n<li>5bcd2d8ed243d6a452d336c05581291bc63ee489795e8853b9b90b5f35c207d8:\u00a0RDN\/Generic PWS.y<\/li>\n<li>437351c9ae0a326ed5f5690e99afc6b723c8387f1ed87c39ebcce85f9103c03a:\u00a0Fareit-FCH<\/li>\n<li>9f346deed73194928feda785dca92add4ff4dd19fbc1352cebaa6766e0f69a38:\u00a0Generic PWS.o<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>DocuSign, which provides electronic signatures and digital transaction management, reported that email addresses were stolen by an unknown party on&#8230;<\/p>\n","protected":false},"author":674,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[4452,32,180,4675,4140],"coauthors":[3973],"class_list":["post-74198","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-cybersecurity","tag-data-protection","tag-malware","tag-password-security","tag-quarterly-threats-report"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Misuse of DocuSign Email Addresses Leads to Phishing Campaign | McAfee Blog<\/title>\n<meta name=\"description\" content=\"DocuSign, which provides electronic signatures and digital transaction management, reported that email addresses were stolen by an unknown party on May\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Misuse of DocuSign Email Addresses Leads to Phishing Campaign | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"DocuSign, which provides electronic signatures and digital transaction management, reported that email addresses were stolen by an unknown party on May\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2017-06-01T21:23:45+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-03T03:50:12+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/spam_docusign.png\" \/>\n\t<meta property=\"og:image:width\" content=\"384\" \/>\n\t<meta property=\"og:image:height\" content=\"513\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"McAfee\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/\"},\"author\":{\"name\":\"McAfee\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\"},\"headline\":\"Misuse of DocuSign Email Addresses Leads to Phishing Campaign\",\"datePublished\":\"2017-06-01T21:23:45+00:00\",\"dateModified\":\"2025-06-03T03:50:12+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/\"},\"wordCount\":508,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/05\/spam_docusign-225x300.png\",\"keywords\":[\"cybersecurity\",\"data protection\",\"malware\",\"password security\",\"Quarterly Threats Report\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/\",\"name\":\"Misuse of DocuSign Email Addresses Leads to Phishing Campaign | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/05\/spam_docusign-225x300.png\",\"datePublished\":\"2017-06-01T21:23:45+00:00\",\"dateModified\":\"2025-06-03T03:50:12+00:00\",\"description\":\"DocuSign, which provides electronic signatures and digital transaction management, reported that email addresses were stolen by an unknown party on May\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/05\/spam_docusign-225x300.png\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/05\/spam_docusign-225x300.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Misuse of DocuSign Email Addresses Leads to Phishing Campaign\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\",\"name\":\"McAfee\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"caption\":\"McAfee\"},\"description\":\"We're here to make life online safe and enjoyable for everyone.\",\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/x.com\/McAfee\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Misuse of DocuSign Email Addresses Leads to Phishing Campaign | McAfee Blog","description":"DocuSign, which provides electronic signatures and digital transaction management, reported that email addresses were stolen by an unknown party on May","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Misuse of DocuSign Email Addresses Leads to Phishing Campaign | McAfee Blog","og_description":"DocuSign, which provides electronic signatures and digital transaction management, reported that email addresses were stolen by an unknown party on May","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2017-06-01T21:23:45+00:00","article_modified_time":"2025-06-03T03:50:12+00:00","og_image":[{"width":384,"height":513,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/spam_docusign.png","type":"image\/png"}],"author":"McAfee","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/"},"author":{"name":"McAfee","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa"},"headline":"Misuse of DocuSign Email Addresses Leads to Phishing Campaign","datePublished":"2017-06-01T21:23:45+00:00","dateModified":"2025-06-03T03:50:12+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/"},"wordCount":508,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/05\/spam_docusign-225x300.png","keywords":["cybersecurity","data protection","malware","password security","Quarterly Threats Report"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/","name":"Misuse of DocuSign Email Addresses Leads to Phishing Campaign | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/05\/spam_docusign-225x300.png","datePublished":"2017-06-01T21:23:45+00:00","dateModified":"2025-06-03T03:50:12+00:00","description":"DocuSign, which provides electronic signatures and digital transaction management, reported that email addresses were stolen by an unknown party on May","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/05\/spam_docusign-225x300.png","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/05\/spam_docusign-225x300.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/misuse-of-docusign-email-addresses-leads-to-phishing-campaign\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Misuse of DocuSign Email Addresses Leads to Phishing Campaign"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa","name":"McAfee","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","caption":"McAfee"},"description":"We're here to make life online safe and enjoyable for everyone.","sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/x.com\/McAfee"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/74198","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/674"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=74198"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/74198\/revisions"}],"predecessor-version":[{"id":214982,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/74198\/revisions\/214982"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=74198"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=74198"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=74198"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=74198"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}