DocuSign With No Subject: Two Hops to a Malicious Page

There was no subject line. Not a vague one, not a string of blank spaces engineered to look empty, nothing at all. The header field simply was not present. Underneath that absence sat a clean DocuSign-branded notification asking the reader to review a document.

The reader was the president and chief executive of a small professional-services company, a single mailbox, tagged internally as a VIP recipient. The message passed SPF. It passed DKIM twice, once for the sending domain and once for the Amazon SES infrastructure that carried it. DMARC passed. Microsoft composite authentication returned a full-confidence pass. Every wire-level control that could have objected had nothing to object to.

The button labeled Review Document pointed at a legitimate transactional-email click tracker. That tracker forwarded to a second redirect domain, which handed the browser to a page the link scanner had already scored Malicious.

A Header Field That Was Simply Absent

Missing subjects are rarely tradecraft. They are more often an artifact of sloppy automation, a template variable that never resolved at send time. The effect still works in the attacker's favor twice over.

Filtering that keys off subject text has nothing to grade: keyword rules, urgency-phrase heuristics, and subject-line reputation scoring all sit idle when the field does not exist. Meanwhile the human sees an empty row in a crowded inbox from a name they do not recognize, and curiosity does the rest. The 2024 Verizon Data Breach Investigations Report puts the median time to click a phishing link at 21 seconds. Not much deliberation happens in that window.

The display name was an ordinary personal name with no tie to the sending domain and no history with the recipient. Inside sat a faithful DocuSign document-review layout.

Borrowed Authentication From a Compromised Sender

The sending domain belongs to an agricultural processing company in East Africa, a real business with no relationship to the recipient, to DocuSign, or to document workflows. It is not a lookalike, a typosquat, or a spoof.

That distinction explains the authentication result rather than contradicting it. The message left Amazon SES infrastructure in the eu-west-2 region from 23[.]249[.]218[.]8, carrying two valid DKIM signatures: one for the sending domain itself and one for amazonses[.]com. SPF authorized the egress address. DMARC aligned and passed. Composite authentication scored a full pass.

The attacker was sending as an organization that had lost control of its mail, which is why the SPF result was accurate and useless in the same breath. Authentication answers whether a message came from infrastructure the domain owner permits, never whether the human at the keyboard is the domain owner.

Two Hops Behind One Trusted Button

The Review Document call to action did not point at anything with a bad reputation. It pointed at Mandrill, the transactional sending arm of a mainstream marketing platform, on the tracked-click path hxxps://mandrillapp[.]com/track/click/31626734/ppsrq[.]org, with the real destination packed into a long base64 parameter.

Decode that parameter and the next hop appears: ppsrq[.]org, on a short opaque path. The JSON structure inside the tracker payload names the final destination outright, hxxps://adobe[.]safest[.]org/, which is where the chain terminates and where the scanner verdict came back Malicious.

Three hops, and only the last one is hostile. A URL reputation check that resolves the first hop sees a well-known transactional email platform with years of legitimate delivery, and stops reasoning there. The tracker is not compromised and does not need to be, because rewriting arbitrary destinations into a trusted domain is exactly the feature it sells. The chain is assembled entirely from services behaving as designed.

One Brand in the Envelope, Another at the Destination

The lure is DocuSign. The landing domain reads adobe[.]safest[.]org.

That is not Adobe infrastructure. The adobe label is an attacker-controlled subdomain sitting on safest[.]org, chosen so the leftmost word of the hostname carries a recognizable e-signature brand while the registered domain underneath carries a reassuring adjective. A recipient glancing at the address bar gets a brand name and a calming word before anything else registers.

The mismatch is also a signal. When the envelope impersonates one e-signature brand and the destination hostname invokes a competitor, no legitimate workflow explains the pair, and both are stagecraft.

See Your Risk: Calculate how many threats your SEG is missing

The Genuine Footer Doing the Heavy Lifting

Underneath the malicious button sat a full page of real DocuSign footer links: Terms of Use, Privacy, Contact Us, Support, Report Email, Download App, plus a copyright line. Every one of them scanned clean, because every one was authentic.

This is reputation by adjacency. A scanner weighing clean links against suspicious ones sees a message that is benign by volume, one hostile call to action surrounded by legitimate destinations. A human sees the furniture of a real notification. Attackers copy footers wholesale precisely because trust is inferred from the parts of an email nobody reads.

What actually resolved the case was context, not link arithmetic. The Adaptive AI behind Themis weighed a first-time sender with no relationship history, a document-review pretext aimed at a VIP mailbox, phishing-consistent wording, a malicious destination at the end of the tracked link, and a community reputation match to earlier reports of the same pattern from other organizations. Confidence landed at 84 percent, and the message was quarantined roughly nine seconds after it reached the mailbox, with no analyst involved.

Indicators of Compromise

MITRE ATT&CK Mapping

• T1566.002 Phishing: Spearphishing Link: the entire payload was one rewritten link on a reputable tracking domain.
• T1204.001 User Execution: Malicious Link: the chain only advances when the recipient clicks the document-review button.

What This Attack Should Change

Three things follow, and none of them is another authentication check.

Inspect the whole chain, every time. First-hop reputation is the single weakest control in modern link filtering, and transactional trackers, marketing redirectors, and URL shorteners all exist to put a trusted name in front of an arbitrary destination. Malicious URL protection that resolves to the terminal hop is the difference between scoring a tracker and scoring the payload.

Treat a compromised legitimate sender as the normal case, not the exception. The FBI Internet Crime Report has documented for years how much fraud rides on mail that is technically impeccable. When a real domain with valid signing keys sends a message that makes no business sense, the anomaly is the relationship, not the cryptography.

Score the absences too. A missing subject line, a display name with no history, a document request with no prior thread, and a footer more complete than the body are each forgivable alone and damning together. CISA phishing guidance makes the same argument: layered detection has to read context, because the wire-level facts of a well-built phish all come back clean.