New Phishing Attack Impersonate as DocuSign Deploys Stealthy Malware on Windows Systems
A recent phishing campaign has been identified, utilizing counterfeit DocuSign notifications to install covert malware on Windows systems.
A recent phishing campaign has been identified, utilizing counterfeit DocuSign notifications to install covert malware on Windows systems.
Phishing Tactics and Malware Deployment
The phishing emails mimic genuine DocuSign branding, prompting recipients to review a pending agreement via a link purportedly hosting the file. Upon clicking, the process transitions from a web browser to a multi-stage loader designed to bypass basic email and endpoint security measures.
The phishing link directs users to a webpage requesting an access code before displaying the alleged document. This mechanism enhances credibility and prevents access by automated sandboxes, which lack the correct code.
Behind the scenes, a script determines the subsequent stage, typically a download masquerading as a benign PDF or zipped contract.
A recent phishing campaign has been identified, utilizing counterfeit DocuSign notifications to install covert malware on Windows systems.
Researchers at JOEsecurity identified the malware through analysis in Joe Sandbox Cloud Basic, revealing the access-code gate, time-based checks, and additional packing techniques. Their detailed technical analysis illustrates how the loader activates at specific time intervals, decrypting its payload solely in memory, which unveils the process tree and network communications associated with this activity.
Infection Mechanism and Stealth Tactics
Upon executing the downloaded file, a script or macro triggers a PowerShell command, retrieving the next phase from an attacker-controlled remote server. This command employs obfuscated strings, environment variables, and encoded segments to conceal its purpose from straightforward detection rules.
powershell -EncodedCommand $enc -WindowStyle Hidden -ExecutionPolicy Bypass
After decryption, the script loads a .NET component directly into memory, executing it as a child process of a trusted application such as explorer.exe, and injects the main payload into the host process. The malware achieves persistence by creating a registry Run key or a scheduled task that executes the script with a new access code.
Due to the malware's in-memory operations and reliance on trusted host processes, robust endpoint logging and network monitoring are critical for detecting this DocuSign-themed attack.
Based on reporting by Cyber Security News.