New Phishing Attack Impersonate as DocuSign Deploys Stealthy Malware on Windows Systems

A DocuSign-themed phishing wave is delivering a multi-stage Windows malware loader: victims are lured to a gated page that presents an access code, then a downloaded lure triggers an obfuscated PowerShell command which loads a .NET component in memory, injects the main payload into trusted processes, and establishes light persistence via Run keys or scheduled tasks. The campaign employs sandbox-evasion (access-code gate, time-based checks), packing/obfuscation, and in-memory execution to avoid detection, and was analyzed by Joe Sandbox researchers.