Don't fall for a mail asking for rapid Docusign action – it may be an Azure account hijack phish

Palo Alto Networks Unit 42 tracked a Europe-focused phishing campaign that sent DocuSign-themed PDFs and HubSpot form redirects to ~20,000 targets across automotive, chemical and industrial manufacturing sectors; the actors harvested Azure credentials via fake Outlook Web Access pages and attempted persistence and tenant access, with researchers collecting IoCs and noting infrastructure (some active) while blocking the attackers before major data theft.