New DocuSign-Themed Phishing Scam Delivers Stealth Malware to Windows Devices

New research details a DocuSign-branded phishing campaign that lures victims to a lookalike site to download a fake signed installer which, after an access-code verification with a C2 server and time-based checks, loads a packed second-stage binary that ultimately drops the Vidar information-stealer — a malware that targets browser data, credentials and crypto wallets. The chain leverages legitimate code-signing, gated execution, online time checks and layered obfuscation to evade automated sandboxes and delay analysis, increasing the likelihood of successful compromise before defenders can respond.