Fake Microsoft Quarantine Hides a DocuSign NDA Trap

The email looked like a Microsoft quarantine notice. Inside it sat a DocuSign notice. And behind the button that promised to reconcile the two was a chain of legitimate safelink rewriters ending at a domain that had already been flagged malicious. One message, two trusted brands, and a payload laundered through security tooling that exists to stop exactly this.

An IT project manager at a large engineering consultancy received it on a Thursday afternoon. The subject line read "Entry Limitations MSG ID:#061bc..." followed by a forty-character hex string. The body rendered the familiar Microsoft "Review These Messages" quarantine layout, right down to the copyright footer, the Privacy Statement link, and the "Learn why this is important" sender-identification notice.

Two brands, one envelope

The cloned Microsoft shell was only the outer wrapper. Nested inside it was a second panel styled as a "Confidential Message" card listing a sender of na3@docusign.net, a subject of "Reminder: Non Disclosure Agreement pending for renewal and signature," and a bright blue "Review Message" button. The design gives the recipient two reasons to act. Microsoft says a message is being held. DocuSign says a contract needs a signature. Neither claim is true, and both logos are doing the same job: manufacturing trust the sender never earned.

This is nested brand impersonation, and it maps cleanly to MITRE ATT&CK T1656 (Impersonation) stacked with T1036.005 (Masquerading: Match Legitimate Name or Location). The attacker did not spoof a display name and hope for the best. They rebuilt two well-known transactional templates pixel for pixel. The FBI's 2024 IC3 report logged more than 193,000 phishing and spoofing complaints, and brand mimicry of this quality is why the category keeps growing. When the counterfeit is this good, the human eye is not a reliable control.

The button was the whole attack

The "Review Message" call to action pointed at a long, multi-stage encoded URL. That encoding is the interesting part. The redirect path threaded through recognized link-protection and URL-rewriting services (observed references in the chain included secure-web.cisco.com, Sophos protection domains, and Barracuda cudasvc links) before it resolved anywhere useful. Those services are legitimate. Security gateways rewrite outbound links into their own domains so they can scan them at click time. Attackers know this, so they stack trusted rewriter domains in front of the real destination. The visible link reads like a Cisco or Sophos address. The destination stays hidden until the last hop resolves.

That last hop was scale.kusbilisim[.]com, a domain independently flagged malicious. A second domain, signatureforemail[.]com, was used to render an email-signature element and carried a mixed verdict rather than a clean one. The laundering is the technique here, mapping to T1566.002 (Phishing: Spearphishing Link) and T1204.001 (User Execution: Malicious Link). Wrapping a flagged endpoint in three legitimate rewriters is a bet that scanners will stop at the first trusted domain and score the link clean. It is a bet that pays off against tools that only inspect the surface URL.

See Your Risk: Calculate how many threats your SEG is missing

Authentication said yes

Here is the part that should bother anyone who still equates a green auth check with safety. This message passed everything. SPF passed. DKIM passed twice, once for the sending domain and once for Amazon SES. DMARC returned best-guess pass. Composite authentication passed, and Microsoft assigned it a spam confidence level of 1, meaning the tenant's own filters delivered it as legitimate mail.

None of that was a spoof. The message was sent through a legitimate company's compromised Amazon SES account. The sending domain was registered in 2000 and had a clean reputation, so the signatures were real and the alignment held. This is why the Microsoft Digital Defense Report 2024 keeps hammering the point that identity and infrastructure abuse now outpace malware as the initial access story. The 2026 Verizon DBIR puts phishing behind 16% of breaches as initial access and credentials in the chain of 39%, and cases like this one show why: the attacker did not need to break authentication. They rented it, through someone else's abused account.

Two tells the headers could not launder: the sender was a first-time correspondent to this mailbox, and the display name was a wall of pipe-delimited junk tokens ("NoReply|Department|Notification|hvdeqak|neezayo|..." trailing into random strings). Authentication verified the envelope. It never looked at the story the envelope was telling. That gap is the entire business case for M365 email security augmentation.

What actually caught it

The message was auto-quarantined within a minute of arrival, and so were two follow-up waves the same account sent that evening. The signal was not the auth result, because auth was clean. It was the behavior: a first-time sender, a noisy display name, a double-brand nesting pattern that no real Microsoft or DocuSign notice produces, and a call to action encoded through a redirect chain that terminated at a flagged domain. Themis, our Adaptive AI, reads those signals in combination the way an experienced analyst would, rather than clearing a message because its SPF record checks out.

The takeaway for defenders is uncomfortable but simple. When a message clears SPF, DKIM, and DMARC and still turns out to be a credential harvesting attempt wrapped in two brands and a redirect chain, the authentication layer did its job and the intent layer was left undefended. Independent research reinforces the scale of that gap: legacy gateways miss roughly 67.5 phishing emails per 100 mailboxes every month, according to IRONSCALES platform data across 1,921 analyzed organizations. Train users to treat any emailed "review your quarantine" button as hostile by default and to reach the quarantine portal only through a known login. The one control the attacker could not clone was behavior over time.

See You Next Time

Auth passed, two brands vouched for the message, and the malicious link hid behind three security vendors' own domains. The only thing that flinched was the model watching how the sender actually behaved.