A CFO's DocuSign Lure That Passed Every Auth Check

The most convincing thing about this attack was not the DocuSign branding. It was that the eSignature notification sitting in a CFO's inbox passed SPF, DKIM, and DMARC cleanly, carried a compauth pass, and arrived through a legitimate Mimecast secure email gateway. Every header signal a filter is trained to trust said this message was fine.

It was not fine. The single "REVIEW DOCUMENTS" button routed through two separate security vendors before dropping the CFO on a typosquat domain that no scanner could confidently clear.

The target was the CFO of a classic-vehicle auction house, addressed directly, from a sender the organization had never received mail from before. First-time senders are worth a second look on their own. This one had done the work to make that second look reassuring rather than alarming.

The authentication was real, because the domain was

The message originated from a real, long-registered South African business domain, firstnet[.]co[.]za, with no obvious relationship to the auction house or to DocuSign. It relayed through a legitimate Mimecast gateway. That combination is why SPF, DKIM, DMARC, and compauth all returned passes. The mail genuinely came from that domain, and it genuinely transited a reputable service.

This is the trap in reading authentication as a safety verdict. SPF, DKIM, and DMARC confirm that a message came from where it claims and was not tampered with in flight. They do not evaluate intent. An attacker who sends from a real domain, whether compromised or simply abused as relay infrastructure, inherits every green checkmark that domain has earned. Stolen credentials were involved in 38% of breaches in the 2024 Verizon Data Breach Investigations Report, and abused-but-authenticated senders are exactly how that access gets laundered into inboxes.

The body contradicted the brand it was wearing

The lure impersonated a DocuSign eSignature request, a template most finance leaders process on autopilot. But the signing instructions were wrong in ways a genuine DocuSign flow never is.

The email referenced a non-standard regional variant, presented in the body as DocuSign[.]co[.]uk, and told the recipient to manually enter a "security code" to open the documents. Real DocuSign envelopes do not route recipients to a regional consumer-looking variant, and they do not ask for a manually typed security code entered from the email body. This mismatch between the borrowed brand and the actual mechanics was the strongest tell in the entire message. It also required reading the content, because nothing in the headers exposed it. NIST defines phishing as deception that tricks a recipient into revealing sensitive information or taking an unsafe action, and deception, not technical compromise, is exactly what this message ran on.

The Microsoft Digital Defense Report 2024 makes the same point at scale: identity and impersonation attacks succeed by looking routine, not exotic. When the wrapper is a familiar brand and the auth is clean, the abnormal detail hides in the fine print of the instructions.

Two security vendors, one obscured destination

The "REVIEW DOCUMENTS" call to action is where the engineering showed. The visible link did not point at a landing page. It pointed at a Mailinblack securelink redirector, a legitimate link-rewriting service. That redirector forwarded to linkscan[.]io, a legitimate URL-scanning service. Only after those two hops did the chain resolve to its terminal destination.

Both Mailinblack and linkscan.io are real third-party security tools. That is precisely why they were useful to the attacker. A filter or an analyst glancing at the outbound link sees reputable security-vendor domains, not attacker infrastructure. Each hop delays and frustrates automated destination verification, which is the entire reason the chain exists. It is User Execution built on borrowed reputation.

The terminal page, visible through the scanner's own screenshot capture, resolved to briggselectrlc[.]co, a lookalike typosquat domain. Notably, the scan returned only a partial, unresolved-confidence verdict rather than a clean malicious flag. That ambiguity is not a gap in the story. It is the story. The redirect chain is designed to leave automated tooling unable to say the destination is bad, so the message rides through on its clean headers.

See Your Risk: Calculate how many threats your SEG is missing

Indicators of Compromise

MITRE ATT&CK mapping

This attack maps to Spearphishing Link (T1566.002), the DocuSign eSignature lure delivered to a single high-value recipient; Impersonation (T1656), the borrowed DocuSign brand and non-standard signing pretext; and User Execution: Malicious Link (T1204.001), the redirect chain that depends on the CFO clicking through the wrapped call to action.

Where header trust runs out and behavior takes over

A gateway that scores this message on authentication and sender-domain reputation grades it as safe, because on those axes it is. That is the structural blind spot of any control that trusts the envelope. Legacy secure email gateways (SEGs) miss an average of 67.5 phishing emails per 100 mailboxes each month, and authenticated brand-impersonation lures are a large part of that gap.

Themis, our Adaptive AI, weighs the signals a header check ignores: a first-time sender reaching the CFO directly, a DocuSign impersonation pattern paired with instructions that do not match a real DocuSign flow, and a call to action that unwraps through multiple redirectors to an unresolved typosquat. Because our Adaptive AI learns each organization's normal sender relationships across 35,000+ security professionals in 17,000+ organizations, an out-of-pattern eSignature request to finance stands out even when every authentication result is green.

CISA's guidance on stopping the phishing attack cycle reaches the same conclusion from the defender's side: reduce reliance on any single indicator, and give people a fast, easy way to report the messages that feel off. The 2024 Verizon DBIR found the median time to click a phishing link is 21 seconds, so the window between delivery and compromise is short enough that content-aware detection, not header trust, has to be the thing standing in the way.

The takeaway: unwrap the link, then judge the sender

Do not let a green authentication verdict or a familiar security-vendor domain in a rewritten URL end the analysis. Unwrap redirect chains to their terminal destination and evaluate that domain, especially for eSignature and DocuSign-styled lures aimed at finance. Pair that with first-time-sender context and behavioral analysis of credential-harvesting patterns, because the attacks that pass every check are exactly the ones your filter was never built to stop.