Unlike conventional phishes, the firm noted that there are no malicious links or attachments involved in this campaign.

Abusing DocuSign for authenticating payments

Attackers create a legitimate, paid DocuSign account that allows them to change templates which they use to craft special templates mimicking requests to e-sign documents from well-known brands, such as Norton AntiVirus.

These fraudulent invoices might feature correct product prices to appear genuine, along with extra charges, such as a $50 activation fee. In other cases, they may include direct wire instructions or purchase orders, Wallarm added.