Threat Actors Use Fake DocuSign for Corporate Data Theft

DocuSign is trusted by over 1.6 million customers, including 95% of Fortune 500 companies, and has more than a billion users. But its popularity has also made it a major target for cybercriminals.

Why DocuSign Is Being Abused

Attackers are using fake DocuSign emails to trick people into sharing login credentials or financial details. These phishing messages often look like real DocuSign requests, asking users to “review documents” through yellow buttons or QR codes.

Clicking these links or scanning the QR codes takes users to fake sites—often designed to look like Microsoft login pages—where sensitive information is stolen.

QR-based phishing is especially dangerous because mobile devices often lack strong security tools, making it easier for attackers to slip through undetected.

These attacks don’t just steal data—they can lead to full network breaches, allowing attackers to move across systems, gain higher access, or even install ransomware.

Cybercriminals are now using real DocuSign accounts to send phishing emails that look completely legitimate. These fake emails often pretend to come from suppliers, government offices, or even HR departments.

Some scams involve fake invoices to steal money. Others use refund fraud tricks, asking people to share personal details over the phone. Some attackers even use DocuSign’s APIs to create official-looking notifications that blend trust with deception.

These scams can lead to:

Unauthorized access to company systems
Financial losses
Personal data leaks on the dark web

A single compromised account can quickly snowball into a much larger breach.

How to Stay Protected

According to an ESET report, businesses should use a multi-layered security approach:

Train employees to spot phishing emails. Look out for strange sender addresses, odd grammar, or mismatched email signatures.
Don’t click links in DocuSign emails. Real DocuSign messages include a security code—log in directly on their site to access documents.
Use multi-factor authentication (MFA) to protect all business accounts.
Enforce strong passwords with a password manager.
Install advanced security tools like ESET to detect malicious links and attachments.
Report suspicious emails to your IT team and DocuSign’s official spam reporting channel.

In Case of a Breach

If you suspect a compromise:

Change passwords immediately
Scan for malware
Isolate affected devices
Monitor the dark web for leaked data

DocuSign makes online workflows easier—but always double-check emails before clicking. Trust should never replace caution in today’s threat landscape.