Living Off the Land: Callback Phishing via Docusign comment · Blog · Sublime Security

Sublime’s Attack Spotlight describes active callback-phishing campaigns that leverage legitimate DocuSign messages and brand impersonation (e.g., PayPal) to socially engineer recipients into calling attacker-controlled numbers or divulging credentials. The report highlights LOTL service abuse, variants across industries, and detection signals used by Sublime’s AI engine to prevent these email-based attacks.