Cyber thieves are making use of DocuSign’s Envelopes API to send fake invoices in good faith, complete with names that are giveaways of well-known brands such as Norton and PayPal. Because these messages are sent from a verified domain – namely DocuSign’s – they go past traditional email security methods and therefore sneak through undetected as malicious messages.
How It Works
DocuSign is an electronic signing service that the user often provides for sending, signing, and managing documents in a digital manner. Using the envelopes API within its eSignature system, document requests can be sent out, signed, and tracked entirely automatically. Conversely, attackers discovered how to take advantage of this API, where accounts set up for free by paying customers on DocuSign are available to them, giving them access to the templates and the branding feature. They now can create fake-looking invoices that are almost indistinguishable from official ones coming from established companies.
These scammers use the “Envelopes: create” function to send an enormous number of fake bills to a huge list of recipients. In most cases, the charges in the bill are very realistic and therefore appear more legitimate. In order to get a proper signature, attackers command the user to “sign” the documents. The attackers then use the signed document to ask for payment. In some other instances, attackers will forward the “signed” documents directly to the finance department to complete the scam.
This article has been indexed from CySecurity News – Latest Information Security and Hacking Incidents