Living Off the Land: Credential Phishing via Docusign abuse · Blog · Sublime Security

This Attack Spotlight describes a credential-phishing campaign that leverages legitimate DocuSign landing pages and PDFs to deliver multistage redirects to fake Microsoft login pages (including QR-code obfuscation). The report highlights attacker tactics—high-reputation domain abuse, link redirects, and use of CAPTCHAs to evade automated analysis—and outlines detection signals and Sublime Security's prevention capabilities.