DocuSign钓鱼邮件活动瞄准科技高管

Cado Security Labs（现为Darktrace旗下）发现了一项针对科技行业高管的DocuSign矛鱼式邮件活动 1。攻击者冒充DocuSign发送恶意邮件，邮件中包含重定向到虚假登录页面的链接，意图窃取用户凭证 1。被盗凭证随后被用于商业电子邮件欺诈（BEC）等后续攻击 1。

此次活动的技术特征表明攻击者采用了多层欺骗手段 1。攻击者利用被入侵的日本企业邮箱域名（包括@anabuki-enter.co.jp和@jaog.or.jp）发送钓鱼邮件，以此规避DMARC安全检查 1。恶意邮件中的JavaScript代码经过base64编码混淆，脚本名称为NdoGg8EElI，用于伪造合法的DocuSign登录界面 1。钓鱼网站则托管在blegabouc[.]com和yperbole9[.]com两个域名上 1。

为防范此类威胁，安全建议包括启用双因素认证、验证发件人真实身份、对未通过SPF/DKIM/DMARC验证的邮件进行标记，以及直接通过DocuSign账户而非邮件链接验证文件真实性 1。

Cado Security Labs, now part of Darktrace, has identified a sophisticated phishing campaign leveraging fraudulent DocuSign emails to target technology industry executives 1. The attackers exploit compromised Japanese business email accounts to send malicious messages containing links that redirect victims to credential-harvesting websites, bypassing DMARC authentication checks in the process 1.

The campaign employs obfuscated JavaScript code, including a script named NdoGg8EElI encoded in base64, to create fake login pages designed to steal user credentials 1. The phishing domains used in the attacks include blegabouc[.]com and yperbole9[.]com 1. Once credentials are obtained, threat actors use the stolen information to conduct further attacks, including business email compromise (BEC) schemes 1.

To mitigate exposure to this threat, security experts recommend enabling two-factor authentication, carefully verifying sender addresses before responding to DocuSign communications, flagging emails that fail SPF, DKIM, and DMARC verification, and validating document authenticity directly through DocuSign accounts 1.