Massive Phishing Campaign Impersonates SharePoint and DocuSign to Steal Corporate Credentials

A widespread and highly deceptive phishing operation is targeting organizations worldwide, masquerading as legitimate notifications from Microsoft SharePoint and DocuSign to steal employee login credentials. Security analysts tracking the campaign report that threat actors have sent more than 40,000 phishing emails in recent waves, leveraging sophisticated social engineering lures that exploit trust in these ubiquitous business platforms.

The campaign's mechanics are notably effective. Attackers craft emails that mimic standard automated alerts from SharePoint regarding a "shared document" or from DocuSign about a "document awaiting your signature." The messages create a sense of urgency, prompting the recipient to click a link to view or sign the purported document. The body of the email and the sender display name are carefully designed to appear authentic, often spoofing known contacts or generic service names like "SharePoint Team" or "DocuSign Notifications."

The critical technical nuance that elevates the threat is the use of malicious links hosted on compromised domains. Instead of using obvious, suspicious URLs, the attackers leverage subdomains or paths on domains that have been previously hijacked or registered to appear legitimate. These domains might use slight misspellings (typosquatting) or incorporate trusted brand names in their structure (e.g., sharepoint-security[.]com or docusign-verify[.]net). This technique allows the phishing links to bypass basic email security filters that block known malicious domains but may whitelist or less scrutinize domains with familiar keywords.

Upon clicking the link, the victim is redirected to a fraudulent login page that is a near-perfect replica of the official Microsoft 365 or DocuSign sign-in portal. The URL in the address bar will typically show the deceptive domain. Any credentials entered on this page are harvested in real-time by the attackers and transmitted to their command-and-control servers.

The impact of such a credential theft is severe and multifaceted. Compromised corporate credentials provide attackers with a direct foothold inside the organization's network. This access can be used for:

• Data Exfiltration: Searching for and stealing intellectual property, financial records, or sensitive personal data of employees and customers.
• Financial Fraud: Initiating unauthorized wire transfers, changing vendor payment details, or committing other forms of financial fraud under the guise of a legitimate employee.
• Lateral Movement: Using the stolen account to send more convincing phishing emails to other employees (a technique known as internal phishing or lateral phishing) and to move laterally across the network to access more critical systems.
• Persistence: Establishing backdoors or creating new administrative accounts to maintain long-term access even if the initial compromised password is reset.

This campaign falls squarely within the high-risk category of Business Email Compromise (BEC) and credential phishing. Its success hinges on the perfect storm of trusted brands, plausible pretexts, and technical obfuscation.

Recommendations for Defense:
Organizations must adopt a defense-in-depth strategy to counter this threat:

1. Advanced Email Security: Deploy solutions that use AI and machine learning to analyze email content, sender reputation, and link behavior beyond simple domain blocklists. Sandboxing of URLs can detect malicious redirects.
2. Multi-Factor Authentication (MFA): Enforcing MFA, particularly using phishing-resistant methods like FIDO2 security keys or certificate-based authentication, is the single most effective control to neutralize stolen credentials.
3. User Awareness & Simulation: Conduct continuous security awareness training that includes examples of sophisticated phishing, like brand impersonation. Regular, simulated phishing exercises help keep employees vigilant.
4. Domain Monitoring: Proactively monitor for the registration of domains that typosquat or incorporate your organization's trademarks and brand names.
5. Zero Trust Principles: Implement network segmentation and strict access controls to limit the damage if credentials are compromised, adhering to a "never trust, always verify" model.

The evolution of this campaign underscores a persistent trend: cybercriminals are investing significant resources into making their phishing operations more targeted, believable, and technically evasive. For the cybersecurity community, it serves as a stark reminder that the human element, combined with evolving technical deception, remains one of the most challenging attack vectors to defend.