Cado Security Labs (now part of Darktrace) identified a Docusign spearphishing campaign targeting tech executives. Attackers use compromised Japanese business emails and malicious links redirecting to credential-stealing sites. The campaign leverages obfuscated JavaScript to mimic legitimate login pages, aiming to steal credentials for further attacks like BEC scams.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Tara Gould
Malware Research Lead
Share
12
Apr 2024
Introduction: Docusign phishing attacks
Researchers from Cado Security Labs (now part of Darktrace) identified a recent Docusign spearphishing email campaign targeting tech executives. Docusign email phishing is a type of email phishing where malicious actors send fraudulent emails mimicking legitimate Docusign communications to trick recipients, typically to input credentials into an illegitimate site. These emails often appear authentic, using Docusign branding and layouts to appear as a legitimate Docusign email. Typically the emails will claim that a document is awaiting the recipient’s signature and include a link to access it. However, the link redirects users to a website designed to steal login credentials. Once these credentials have been stolen, they are likely to be used in further attacks.
Frequently, Docusign phishing campaigns will use legitimate compromised email accounts to send the phishing emails, in an effort to pass Domain Messaging Authentication Record and Conformance (DMARC) checks. Throughout this campaign, and previous Docusign campaigns, legitimate Japanese business emails are used to send the phishing emails that were previously compromised. The use of Japanese email accounts may be due to Japanese domains having a higher reputation, making them less likely to flag spam filters, as opposed to .ng or .ru.[1]
Technical analysis
The first email began with the email subject “BIYH-QPVSW-3617 is ready for your review” from “@anabuki-enter.co.jp”, with the body of the email including a “Review Document Button”. The button directs to a link hosted on “app.getresponse.com”, a legitimate marketing service. This link was down at the time of analysis, however it may have been used to track if the user opened the email or to redirect to another phishing site. Additionally, the user is prompted to visit Docusign.com and enter a security code to access the document.
Figure 1: User is promoted to login to Docusign.com
A separate email was sent with the subject “Please Docusign this document: Share transfer & Subscription Agreement_062024.docx Copy.docx_PM5235627.pdf” by a “@jaog.or.jp” address. Interestingly, the body of the email includes a legitimate email thread between multiple companies, likely to attempt to make the phishing email appear more legitimate. Included in the body of the email is a link to a malicious website containing a Javascript script “NdoGg8EElI”.
“NdoGg8EElI” is an obfuscated Javascript script that contains a series of conditional statements that are base64 encoded.
Figure 2
The script begins with an if statement to check if “https://xx[.]yperbole9[.]com/BrfMyTrgSAvPiJtOFWxtG0clXO/” equals “nomatch”, which it obviously doesn’t, this might just be junk code, along with the subsequent document.write().
Following the document.write blob is the same if statement but with !== this time.
Figure 3
This time the conditions will be true, executing the subsequent code.
Figure 4
Const “AraaqOIGqY” takes the current URL hostname.
Const “aEKzPLUWtg” creates a new URL from base64 which is the “https://xx[.]yperbole9[.]com/BrfMyTrgSAvPiJtOFWxtG0clXO/” domain.
Const “zbwXTqjqwH” checks the URL hostname against “aEKzPLUWtg” and if it doesn’t match it takes the TLD and SLD from the decoded URL.
Next checks compare the hostname and pathname to check if the current page is the same as the base64 domain (https://xx[.]yperbole9[.]com/BrfMyTrgSAvPiJtOFWxtG0clXO/) and if they do the next base64 block executes.
The block contains HTML with a captcha check and a Gmail background image, in an effort to look like a legitimate Google Workspace log in page. The user is then redirected to another phishing page hosted on “blegabouc[.]com”, which was down at the time of analysis but likely prompted the user to enter their credentials.
Figure 5: User promoted to enter Gmail credentials
The next block compares the hostname and pathname to check if they do not match the current page, if this is true a 404 HTML page occurs.
Figure 6
Finally, “zbwXTqjqwH” is checked to not equal “AraaqOIGqY”, which checks if the hostname and decoded base64 URL are not equal. If true the same base64 encoded HTML 404 page occurs again.
The goal of these Docusign campaigns are to steal credentials from businesses that can be used for further attacks including BEC scams, or to sell on marketplaces.
Key takeaways
Docusign phishing attacks are an ongoing issue facing organizations, as they exploit the trusted nature of electronic signature platforms to deceive recipients into sending their credentials. These attacks often leverage familiar branding, compromised email accounts, and tactics like embedding fake email threads to appear legitimate.
To protect against such phishing attempts, it is crucial to be cautious when receiving unsolicited Docusign emails, especially when they ask for urgent action. Users should always:
Mark emails that don’t pass SPF, DKIM and/or DMARC as spam / suspicious.
Educate employees on how to spot phishing emails and actions to take when they identify one.
Verify the sender’s email address and don’t rely on the alias that’s used by mail clients.
Avoid clicking links or opening attachments on unsolicited emails.
Enable 2FA (2-Factor Authentication) on all accounts.
Verify through Docusign account, whether the document is legitimate, by logging into Docusign and accessing Documents or using the Access Code. Docusign Verify can be used to validate the e-signature.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Despite the growing popularity of hybrid environments, most organizations face challenges in achieving unified visibility between on-premises and cloud networks. AI-powered platform tools can bridge this gap in visibility to reduce detection and response times and simplify operations.
From One Alert to a Wider Campaign: Uncovering Novel Threats Through Behavioral Analysis
Key Findings
Darktrace’s Threat Research team is exploring a new method to identify malicious campaigns by correlating similar anomalous activity across its customer fleet.
The method uses unsupervised clustering to identify shared behavioral patterns across multiple customer deployments without relying on prior indicators of compromise (IoCs).
The approach identified shared infrastructure across dozens of customers, with activity linked to the likely POPA botnet.
A second cluster identified anomalous activity associated with Monero cryptocurrency mining.
How does Darktrace conduct threat research?
The Darktrace Threat Research team aims to identify malicious campaign activity affecting multiple customers. By their nature, these campaigns will lead to shared behavioral patterns across multiple victims.
In this piece, we describe a method for identifying malicious campaign activity that uses this simple observation as a guiding principle. We begin by outlining a few key facts about the modern threat landscape and why behavioral detection is necessary to meet the challenges it presents. We then explore how fleet-wide behavioral detections can be leveraged using the principle above to systematically identify multi-deployment campaigns impacting the Darktrace customer fleet. Finally, we demonstrate that this research is not purely theoretical, using real examples of campaign activity detected through this novel approach.
Shifting to a behavioral-focused approach
The modern era of cyber-defense necessitates detection capabilities beyond traditional signature-based methods. Technologies such as antivirus signatures, hash-based malware identification, and IP blocklists have historically been successful in defending against known threats. However, they are easily circumvented by attackers and inherently limited in defending against the novel attack techniques that today's threat landscape is producing.
Recent breakthroughs in AI represent a transformational risk multiplier that cannot be ignored. AI systems do not merely execute existing attacks at machine speed; there are signs they can also synthesize novel tradecraft [1], increasing the likelihood that defenders will encounter attack patterns that have never previously been observed. Meanwhile vulnerability disclosures continue to accelerate. More than 48,000 CVEs were published in 2025, and published statistics to date indicate that 2026 is already on track to significantly exceed that figure [2]. While multiple factors may contribute to vulnerability discovery, AI is seen as a key factor in this rapid growth. Organizations should expect a growing proportion of malicious activity to fall outside the scope of detections that rely solely on prior knowledge of known threats.
By design, Darktrace’s behavioral and anomaly-focused detection capabilities are well-suited to this testing landscape. With a focus on detecting unknown and unexpected activity that deviates from the baseline of “normal” behavior, detection of CVE exploitation without prior knowledge of the vulnerability and before public disclosure, for example, is achievable [3][4].
Darktrace’s diverse customer base benefits from a further layer of protection: working with only deidentified alert metadata, our threat researchers hunt proactively across the fleet. Beyond the level of the individual customer, there is a second, larger vantage to be leveraged.
Darktrace data provides unique insight into the unexpected behavioral patterns that occur across its customer fleet. What can we see if we look at this fleet-wide telemetry and hunt for systematic behavioral campaigns that impact our customer base?
Correlating across the customer base
At the deployment level, Darktrace focuses on whether activity is unusual in the context of an organization's normal behavior, but as we zoom out and look at these alerts at the fleet level, the problem fundamentally changes . We are no longer seeking anomalies in largely normal data; we are seeking systematic patterns within data already known to be anomalous. An isolated behavior anomaly may be notable for a single customer; the same fingerprint across dozens is a signal of a structured campaign. Hunting for such campaigns and sharing our findings are key areas of focus for Darktrace’s Threat Research team. In this spirit, Darktrace is actively exploring a a new research approach that leverages deidentified alert metadata to increase campaign detection ability.
This approach is based on the premise that an expert human analyst presented with a set of alerts will identify likely related activity by assessing whether the metadata fields indicate a relationship. For example, two connections to a rare endpoint that exhibits naming structure that is likely from a single algorithm are a strong indicator, as is the use of an unusual port carrying a given protocol (e.g. port 6000 for SSL). Darktrace’s approach to campaign detection encodes this expert human judgement process through deterministic embedding functions that obtain reproducible vector representations of alert data. Unsupervised clustering is then applied to these vector representations to obtain groups of alerts that describe semantically similar alert data across multiple customers. These clusters therefore represent similar anomalous activity that has occurred across multiple customers. In other words, these clusters are candidates for malicious campaign activity.
Figure 1: Layers of AI-based analysis provided through Darktrace products and cross-customer correlation.
Case study 1 – unusual connections to shared underlying infrastructure
In one recent case, the clustering produced several tight groups of alerts spanning dozens of customers. Each group centered on a single domain whose subdomains were algorithmically generated (e.g. s01699, s1736, s91). Examined side by side, these clusters shared an unmistakable behavioral shape: each involved a domain with a clear naming pattern (e.g. s016841786.net-echo[.]com, s1670.pixellog[.]io, s217.pixellog[.]io) , with connections over SSL on the unusual port 6000 to servers hosted by non-mainstream providers (e.g. OVH, Hetzner, GTHost, Leaseweb), rather than generally expected content-delivery networks.
Figure 2: An example model alert triggering on unusual outbound connections and data transfer to s1670.pixellog[.]io.
Closer inspection revealed that the same subdomain label appeared under different domains (e.g. s1786.net-echo[.]com and s1786.pixellog[.]io). Following this lead, Darktrace’s threat researchers pivoted across the customer base and found numerous distinct subdomain labels reused under more than one registered domain. In several cases, the same label resolved to the same IP across different domains (e.g. s1704 under both pixellog[.]io and net-echo[.]com → 148.113.222[.]244; s01684 → 15.235.67[.]95), suggesting the use of ephemeral subdomain infrastructure in an attempt to avoid signature-based defense techniques.
This example demonstrates how multi-deployment data can uncover shared infrastructure that may be difficult to identify at the individual deployment level alone. In particular, the presented method facilitated this discovery by producing coherent, tight clusters of geometrically similar vector embeddings of malicious activity from large-scale fleet data, which could then be presented to a researcher for further investigation. This activity highlighted across the Darktrace customer base was ultimately linked to likely POPA botnet activity through use of open-source intelligence (OSINT) [5].
Case Study 2 – anomalous user agent and txt URI
A second example shows the method surfacing a single, self-contained cluster. The clustering was not given any indicators to look for; instead, it grouped devices that shared an unusual combination of features. On inspection, that shared consisted of:
- unusual user agent (tes)
- specific request path (/md5_GIP.txt)
- uncommon destination port (83)
- hostname impersonating Google (matching regular expression ^www\.google\.com\.[a-zA-Z0-9]+\.fast-dns-host\.com$)
Treating these shared features as IoCs, Darktrace’s threat researchers then pivoted to an exploration across the customer base to investigate the full breadth of the campaign. This search identified further commonalities; additional domains which shared the same IP as the domain family highlighted in the cluster, as well as evidence of cryptocurrency mining on affected devices. Additional OSINT research also aligned with these findings, linking the discovered payloads and infrastructure to Monero cryptocurrency mining [6].
Conclusion
The method outlined in this blog is under active development, with ongoing technical refinement providing opportunities to further enhance its capabilities. While the capability continues to mature, this approach to threat hunting leverages the powerful vantage point of fleetwide telemetry across a diverse customer base to help protect Darktrace customers. This method allows campaigns that at the deployment level appear as isolated alerts to be seen at their true scale and spread. It enables proactive fleet-wide analysis without prior IoCs to identify campaigns impacting Darktrace customers.
This is possible because of what the method is built on: the atomic unit is the Darktrace alert, a signal that encodes years of cyber expertise, while the multi-deployment nature of the method allows organizations to indirectly benefit from findings from other networks through shared intelligence by Darktrace’s Threat Research team.
Credit to Daniel Levy (Threat Hunting Data Scientist), Paul Jennings (Principal Cyber Analyst), Emma Foulger (Global Head, Threat Operations)
“I wonder if running that tool influenced the connectivity in some way.”
“I might need to target down or reboot, but first, I'll investigate the network using ARP. I wonder if ARP is responding properly. If I see "ip neigh stale," that could indicate a problem. I think arping might help in this situation, but I’ll need to keep an eye on how the network is behaving. It's all about figuring out where the issue lies!”
図10：エージェントの異常なLDAPアクティビティに対してトリガーされたこのLinuxサーバーに対するモデル検知は、Cyber AI Analystによって自律的に調査され、その調査結果にはエージェントの異常なSMBセッションアクティビティに関する内容が含まれ、Cyber AIAnalystインシデントに記録されました。
DarktraceのCyber AI Analystは、エージェントのアクティビティによってトリガーされたモデル検知を自律的に調査し、その調査結果を1つの重要なインシデントレポートにまとめました。インシデント報告書の内容は、エージェントによるネットワークスキャンから始まりコーディング演習内容のSMBベースの上書きで終わる、エージェントの行動の各段階を詳しくカバーしています。
図20：Cyber AI Analystは、モデル検知に対する自律的な調査を通じて得られた所見をつなぎ合わせ、エージェントの進行状況のタイムラインを作成し、アクティビティを視覚的に表したグラフとともに提供しました。
Cyber Verification Program下のAnthropic Opus 4.6モデルなど、他のフロンティアモデルを使用したエージェントも、Darktraceのシミュレートされた環境で同じ設定とタスクを使ってテストされました。反復の度に、エージェントは演習の内容または採点プログラムを変更して不正を行おうとしました。基盤となるモデルに関係なく、エージェントは自分が置かれた環境を侵害することで、100％のスコアを達成する方法を見つけることに成功していました。これらのエージェントによるハッキングは、アクティビティの内容こそ違っていましたが、すべてその環境のベースラインの振る舞いから大きく逸脱した動作を引き起こしていました。これらの逸脱はDarktraceプラットフォームに十分な検知の機会を提供し、エージェントの逃げ場はありませんでした。
.avif)
