A DocuSign Lure Laundered Through Google Redirectors

The message announced an Electronic File Notification, styled to look like a DocuSign envelope waiting for review. It arrived at the mailbox of a US company president. The subject line was the tell that this was not a mass blast: it carried the recipient's own email address, embedded directly in the subject, alongside a fabricated check number meant to read like a payment reference.

And the message passed everything. Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) all returned a pass. The composite authentication result registered as pass with reason 100, the strongest signal an inbound mail filter can receive. None of it was a lie. The email really did come from the domain it claimed. That domain just did not belong to the attacker.

The Sender Was Real. The Owner Did Not Send It.

The From address belonged to an Australian waterproofing company. The mail left that company's genuine infrastructure, signed with its own DKIM key (selector1) and aligned to its published SPF and DMARC records. This is the difference between spoofing and compromise. A spoofed lookalike domain fails alignment and gets caught. A genuine mailbox that an attacker controls signs and aligns perfectly, because the messages are, mechanically, authentic.

This maps to MITRE ATT&CK T1586.002 (Compromise Accounts: Email Accounts). Authentication confirms that a message came from a domain. It says nothing about whether the domain's owner intended to send it. The 2024 Verizon Data Breach Investigations Report found the human element factored into 68% of breaches, and a hijacked mailbox is that element weaponized at the source.

One earlier relay hop in the header trail did show an SPF fail, a transient artifact from an intermediate handoff, before the message re-validated through the legitimate Outlook and ARC path. By the time it reached the inbox, every visible check was green.

Three Hops Through Google's Own Redirectors

The call to action (CTA) link in the DocuSign body did not point at anything suspicious on first inspection. It pointed at Google. Specifically, it began a three-stage chain through legitimate Google infrastructure:

meet[.]google[.]com/linkredirect handed off to google[.]com/url, which handed off to adservice[.]google[.]com[.]ph, the Philippine ad-service variant. Only after those three trusted hops did the chain resolve to attacker-controlled infrastructure.

Google redirect services are among the most abused link-laundering mechanisms in phishing, and the reason is structural. The first domain a URL scanner evaluates belongs to Google, which is on every allowlist and carries maximum reputation. A scanner that evaluates the first hop and stops marks the link clean. Chaining three Google services together is redundancy: even a scanner that follows one redirect may not follow all of them, and each hop pushes the real destination further out of reach. This is MITRE ATT&CK T1566.002 (Spearphishing Link) executed through borrowed trust rather than a raw malicious URL.

The Hijacked WordPress Admin Panel

The chain terminated at hxxp://empiredevelopments[.]com[.]pk/wp-admin/40b9nrbv/. This is a Pakistani business domain, and the path sits inside its WordPress administration directory. The site was hijacked, its admin area repurposed as a credential-harvesting endpoint under a randomized subfolder.

Two anomalies mark it as compromised rather than purpose-built. First, the page was served over plain HTTP with no Transport Layer Security (TLS) encryption at all, unusual for any page collecting credentials and a hard signal that the attacker reused whatever the hijacked host already offered. Second, the hosting IP address, 95[.]217[.]117[.]68, geolocated to Finland, while its reverse DNS pointer (PTR) record resolved to fly[.]hosters[.]pk, a Pakistani hosting provider with no relationship to the Google chain a victim thought they were following. Finnish IP, Pakistani PTR, Australian sender, US target. Nothing about the infrastructure was coherent, because it was stitched together from what the attacker could seize.

Taking over an existing legitimate site is MITRE ATT&CK T1584.004 (Compromise Infrastructure: Server). Paired with the DocuSign brand styling, which is T1036 (Masquerading), the attacker never had to register or defend a single piece of their own reputation.

See Your Risk: Calculate how many threats your SEG is missing

Every Layer Borrowed Someone Else's Trust

Read the chain end to end and a pattern emerges. The sender's authentication was borrowed from a real Australian company. The redirect reputation was borrowed from Google. The hosting was borrowed from a hijacked Pakistani business. The brand recognition was borrowed from DocuSign. The personalization, the recipient's own email address in the subject, was borrowed from the target's own identity to manufacture familiarity. The attacker supplied only the credential-harvesting form at the very end.

The Microsoft Digital Defense Report 2024 describes exactly this shift toward abusing legitimate services and identities to evade reputation-based controls, documented in its threat landscape analysis. When every hop is individually trustworthy, no single reputation check fires. The malice lives only in the composition.

Where Detection Actually Lives

A gateway that grades this message on authentication and first-hop reputation passes it. It was authenticated. It began at Google. It carried no attachment and no obviously malicious domain up front.

Themis, the Adaptive AI analyst built into the IRONSCALES platform, evaluates the behavioral context instead: a first-time DocuSign-style notification from a sender who has never invoiced this recipient, a subject line that reflects the recipient's own address back at them, and a link that unwinds across three redirectors to a plain-HTTP WordPress admin path with mismatched hosting geography. Those signals do not depend on the sender failing authentication, because this sender never did.

The reinforcing layer is scale. Patterns like a hijacked WordPress endpoint reached through a Google redirect chain surface faster when community intelligence across thousands of organizations connects the same infrastructure appearing in unrelated inboxes. The Cybersecurity and Infrastructure Security Agency makes the same case in its phishing guidance: reporting and shared visibility break attack cycles that individual filters miss.

The takeaway is uncomfortable but clarifying. A perfect authentication result is not evidence of safety. It is only evidence that the mail was mechanically genuine. When an attacker sends from a real account, through real redirectors, to a real hijacked site, the only remaining signal is behavior. That is the surface worth watching.

---

Indicators of Compromise