9/3/25, 10:22 PM

Cado Security Labs (now part of Darktrace) identified a Docusign spearphishing campaign targeting tech executives, using compromised Japanese business emails and malicious links that redirect to credential‑stealing sites. The campaign leverages obfuscated JavaScript to mimic legitimate Docusign login pages and aims to harvest credentials for further attacks such as business email compromise (BEC) scams.

In the analysed instance, the first email carried the subject “BIYH-QPVSW-3617 is ready for your review” from “@anabuki-enter.co[.]jp” and directed recipients to a link hosted on a legitimate service, with subsequent messages originating from “@jaog.or[.]jp” addresses and including a malicious Javascript script. The attackers often pass DMARC checks by using legitimate compromised accounts in Japan, a tactic noted in the report as part of their attempt to appear authentic.

The post, dated 12 April 2024, stresses the importance of caution with unsolicited Docusign emails and recommends steps such as SPF/DKIM/DMARC checks, user education, and multi‑factor authentication to mitigate these phishing campaigns.