Skip to main content
Trust Center

Alert: New Phishing Campaigns Discovered

05/27/2020

DocuSign has discovered several new phishing campaigns that spoof DocuSign and are COVID-related. All below campaigns were found in the wild. Details are shared for each below.

  1. From: "Payment Request via DocuSign" <user[@]puabenefit-pay8645752893[.]info> or <filling[@]serv-docpay873644[.]com>
    Reply-to    : user[@]doc-pay[.]info
    Sent: Thursday, May 21
    Subject: "RE: YOUR COVID19 PAYMENT FILLING STATUS" or "COVID-19 HEALTH PAYMENT STATUS" or similar
    Link displays as: hxxps://mindscriptstech[.]com/wp-admin/documen0t9853/doc-new/ 

  2. From: "DocuSign Via Arnulfo Smitham" <docusign-donot-reply[@]Yourpad[.]com>
    Sent    : Thursday, May 21
    Subject: "Affidavit_for_Covid-19 from Yourpad[.]com" or similar
    Link displays as    : hxxps://bit[.]ly/3bnBEsw
    Links redirects to: hxxps://realestatesproperties[.]estate/x787xe8ruh22@/11d4b7f8a0da369d11a95c2ee2267796/95aed2504a6a43d4034b22cacbba5607/login.php?cmd=login_submit&id=5aea4dece5073ba5a0f7113d90b4b6235aea4dece5073ba5a0f7113d90b4b623&session=5aea4dece5073ba5a0f7113d90b4b6235aea4dece5073ba5a0f7113d90b4b623 

  3. From: "KEVIN WATSON" <grayshillrealty[@]yahoo[.]com>
    Sent    : Wednesday, May 20
    Subject: "Re:  Docu  sign. :Complete : File NO 8874871 COVID-19 Report ,termi AND HUD approver QWKLDQXPSO" or similiar
    Link displays as: No URL was provided in the message