What is a Poisoned DocuSign Attack?
A “Poisoned DocuSign” attack is a deceptive cyber method where attackers trick individuals into providing their login credentials, by abusing the DocuSign digital e-signature system.
Unlike typical phishing attempts, this scam is sophisticated and highly convincing. Attackers send emails from legitimate DocuSign addresses, making it even harder to spot.
How Does It Work?
- You receive an authentic-looking email from a legitimate DocuSign email address, prompting you to review and sign a document. For instance, it could be a fake document purporting to be from your employer, asking if you want additional free annual leave.
- Clicking the link takes you to a convincing webpage where you’re asked to complete an “Are you a robot?” verification (Captcha).
- After verification, a fake (but often convincing looking) Microsoft login page appears, asking for your username and password.
- Once you enter your credentials, the site requests a multi-factor authentication (MFA) token.
- Clicking to authenticate then steals your authentication token and login credentials, giving attackers full access to your account.
How to Avoid Being Tricked
- Pause and Verify: Even if an email looks authentic, pause before clicking. Legitimate DocuSign emails rarely prompt you for Microsoft login details.
- Inspect URLs Closely: Hover your mouse pointer over any links (without clicking) to see the actual URL destination. Fake login pages often have subtle differences from genuine sites.
- Be Cautious with Captchas: Genuine DocuSign requests don’t typically include a Captcha verification before accessing documents.
- Avoid Immediate Action: Scammers often pressure you to act quickly. Always take a moment to verify independently.
- Double-Check MFA Requests: Be extra cautious if prompted for MFA authentication unexpectedly, especially after logging into an unfamiliar site.
What to Do if You’re Unsure
- Talk to your manager in the first instance.
- Never enter credentials or authentication tokens if you’re uncertain about the legitimacy of the request.
- Report any suspicious activity promptly to protect yourself and your organisation.