The Fake DocuSign That Detoured Through Google Maps

The detail worth sitting with is what the script appends to that redirect: the recipient's own email address, Base64-encoded, as a URL fragment. The attackers pre-loaded each attachment with the target it was mailed to, so the landing page can greet the victim by their real address and tailor the credential pitch. It is a small touch that does a lot of work, and it confirms this was a prepared, per-target kit rather than a spray. Because the address is scrambled and delivered as an attachment, a content filter scanning the message body sees nothing actionable at all.

See Your Risk: Calculate how many threats your SEG is missing

Mapping to MITRE ATT&CK

The tradecraft lines up cleanly with the MITRE ATT&CK framework:

• T1566.001 Spearphishing Attachment covers the obfuscated HTML file staged to fire its redirect on open.
• T1204.001 User Execution: Malicious Link covers the OPEN DOCUMENT click that walks the victim through the Google Maps hop to the abuse-flagged landing host.
• T1027 Obfuscated Files or Information covers the hex and XOR encoding that hid the real redirect target from static inspection.
• T1598.003 Phishing for Information covers the per-target Base64 email fragment used to personalize the landing page.

Indicators of Compromise

Detection and What to Watch For

A pure authentication verdict was on our side here, and it still was not enough on its own. SPF fail, DKIM absent, DMARC none, empty Return-Path, localhost Message-ID: any one is a strong signal, and the stack of them is damning. The lesson is not that authentication failed. It is that a message this broken at the transport layer still reached a human, which means the tooling watching over that human has to be the backstop.

The signals that matter beyond the failed checks are the mismatch between a DocuSign presentation and a sender that has no relationship to DocuSign, a call to action that launders through a Google redirector before resolving to a dynamic-DNS host, and an HTML attachment whose contents do not render as readable text. This is where IRONSCALES adds a layer static gateways miss. Themis, the Adaptive AI analyst on the IRONSCALES platform, weighs the claimed brand against the actual origin, the redirect chain, and the attachment behavior the way a trained analyst would, flagging the intent even when a message arrives from infrastructure no allow-list has ever seen. The obfuscated attachment and the wrapped link are exactly the surface that advanced malware and URL attack protection is built to inspect, and the six-figure wire demand is textbook payment fraud.

The Takeaway

This is business email compromise in its bluntest form: no clever spoof, no compromised vendor account, just a forged message betting that DocuSign branding and a scary invoice will move money faster than anyone checks the headers. The 2024 Verizon Data Breach Investigations Report puts the human element in 68 percent of breaches and pegs the median business email compromise transaction near 50,000 dollars, and the Microsoft Digital Defense Report 2024 documents the same drift toward abusing trusted services like cloud hosting and mainstream redirectors rather than breaking them. The FBI's 2023 Internet Crime Report ranks business and payment-fraud losses among the costliest categories reported, which is exactly the lever this campaign pulled. Across 35,000+ security professionals and 17,000+ organizations, the pattern holds: the messages that hurt most are rarely the most sophisticated. Verify the destination, never wire against an emailed instruction without an out-of-band confirmation, and let behavioral detection catch what the headers already told you. CISA's guidance on stopping phishing early is a solid reference for building that reflex across a team: https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one