A DocuSign Lure That Passed Every Auth Check

A finance manager at a property-investment firm opened an email that did everything right. It came from a business contact he recognized, at a Canadian condominium-management company he had worked with. It carried DocuSign branding and an Annual Tax Review notice, the kind of routine year-end document a finance role sees constantly. And when the mail system checked the sender, every signal came back green. SPF passed. DKIM passed. DMARC passed. ARC passed. Composite authentication returned a clean pass.

None of that mattered, because the account itself was the attack.

The contact's mailbox had been quietly hijacked. Everything downstream of that compromise inherited the trust attached to a real, decade-old business identity. This is vendor email compromise, and it is the failure mode that authentication was never built to catch: the phish was not spoofed onto the domain, it was sent from it.

Why Every Check Came Back Green

Authentication answers one question. Did this message really come from the domain in the From header. Here the honest answer was yes. The message originated from the legitimate Microsoft 365 tenant of the sending firm, signed with that tenant's own onmicrosoft.com DKIM key, aligned under its DMARC policy, and sealed with a valid ARC chain from the forwarding hops it crossed. The Microsoft 365 edge logged composite authentication as a pass. There was no forged header to detect and no policy to break, because the attacker was operating inside a trusted account rather than impersonating one from the outside.

That is the practical difference between header spoofing and account takeover. Spoofing forges identity on infrastructure the attacker controls, and SPF, DKIM and DMARC exist precisely to catch it. Account takeover borrows a real identity, so the same three checks confirm the message is authentic. The sending domain had been registered since 2014 and ran a genuine property-management business. Ten years of clean reputation became the wrapper around the payload.

The Lure and the Garbled Button

The body was stitched together from forwarded thread fragments and hidden HTML elements, engineered to look like an internal review chain that had simply been passed along. The visible branding leaned on DocuSign, rendered with subtly altered styling such as Docu_Slgn and Docu_Sign so the eye reads the trusted brand while exact-match brand filters see something else.

The call to action carried the same trick. The review button was labeled REVIEW THE DOCUAuaPMENTS, with junk characters wedged into the middle of the word. A keyword filter scanning for document or DocuSign finds no clean match. A busy human reading at speed parses it as a normal prompt and clicks. Garbling a lure mid-word to slip past string matching while staying legible to a person is a small, deliberate piece of tradecraft, and it is increasingly common.

See Your Risk: Calculate how many threats your SEG is missing

Following the Redirect Chain

The button did not point straight at a credential page. It first routed through an open redirect on Google's Sierra Leone country domain, google.com[.]sl, using the /url?q= parameter that some Google properties expose. A link that begins with a Google hostname clears reputation checks and hover inspection alike, because the first thing a recipient or a scanner sees is a trusted name. The redirect then forwarded the browser to the real destination.

That destination was an object hosted on Amazon S3 in the ca-central-1 region, under a bucket path dressed up to imitate a generic storage and file-delivery service. IRONSCALES flagged the page Malicious and captured a screenshot of a credential-harvesting form waiting to collect the finance manager's Microsoft login. Hosting the trap on mainstream cloud infrastructure buys the same cover the compromised mailbox did. S3 is not a domain a defender can simply block, and the bucket had no reputation history to condemn it.

So the chain reads: a trusted compromised mailbox, a fully authenticated message, a legitimate cloud redirect, and a credential page on a legitimate cloud host. At no point does a classic block-the-bad-domain control have a clean target.

Mapping to MITRE ATT&CK

The tradecraft maps cleanly to the MITRE ATT&CK framework:

• T1586.002 Compromise Accounts: Email Accounts is the foundation, the hijacked business mailbox that supplied both the trust and the authentication.
• T1566.002 Spearphishing Link covers the delivery, a targeted message whose payload is a link rather than an attachment.
• T1204.001 User Execution: Malicious Link covers the click that carries the victim through the redirect to the harvesting page.

Indicators of Compromise

Detecting What Authentication Cannot

Reputation and signature checks were never going to stop this one. The sender was trusted, the redirect host was Google, the landing host was Amazon, and the only forged thing in the message was the intent. Detection has to move to behavior and relationship context: a routine business contact suddenly sending a DocuSign tax notice out of pattern, a link that bounces through a foreign Google ccTLD before resolving elsewhere, brand text that renders as DocuSign but fails an exact match, and a first-seen cloud object behind a familiar-looking storage path.

This is where our Adaptive AI on the IRONSCALES platform reads the message the way a trained analyst would, weighing the relationship between the claimed brand, the real sender behavior and the redirect chain instead of trusting a green authentication badge. The 2024 Verizon Data Breach Investigations Report finds the human element in 68 percent of breaches and stolen credentials in 38 percent, and it clocks the median time to click a phishing link at 21 seconds. The Microsoft Digital Defense Report 2024 documents the same shift toward abusing trusted services and identities rather than breaking them, and the FBI's 2023 Internet Crime Report ranks business email compromise among the costliest categories year after year. CISA's early-detection playbook, at https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one, is a good baseline for building that reflex across a team.

The lesson is blunt. A perfect authentication result tells you the message came from where it says. It does not tell you the account is still in the right hands. When the mailbox becomes the payload, the only defense left is a system that judges behavior, not badges.