New HR-Themed Credential Harvesting Phishing Attack Uses Legitimate Signature Platform Yousign

A phishing campaign documented by Agari is abusing the Yousign eSignature platform by sending emails that impersonate an employer's HR department asking recipients to sign an "Employee Handbook." The "Access Document" link leads to a genuine-looking Yousign-hosted page that solicits the victim's name, email, and password, enabling credential theft and potential unauthorized access to corporate email accounts.