You only need to have a digital copy of your credentials and signature to put your name on the dotted line. Tap or click here to find out how to sign any document digitally. There are several online services that provide security and authenticity checks for signing documents, but cybercriminals will also try to beat the system. It’s dangerous when criminals try to spoof signature verification services. Now, security researchers uncovered a scam where criminals send out fraudulent documents to infect the receiver’s device with malware.
Here’s the backstory
In an older version of the scam, hackers created fake DocuSign notifications. Now, the criminals are using DocuSign itself to spread malware. In a rather clever move, the email notification that potential victims receive won’t be flagged as spam. That is because the notification has gone through all the right security channels. But the malware isn’t in the notification email. It is in the document requested to be signed. Since the email notification looks legit, there’s a good chance it won’t be flagged as spam. So you need to be careful when handling unsolicited emails and watch for phishing attempts. Researchers at Avanan explained that hackers could “use steganography within the hosted file or deliver a weaponized piece of malware or ransomware.”
How the DocuSign scam works
Scammers create their own DocuSign account, which is free for anyone. They have also been found to use hijacked DocuSign accounts to lend more authenticity to the communications. Once a document has been uploaded to their account, the hackers will notify potential victims through phishing emails. They will claim that you must sign the document to proceed with whatever reason they make up. The invitation email that arrives will seem like a regular DocuSign link (and it is), but once it is clicked, the malicious document will open and infect your device with malware. Even if you download the document for later inspection, the malware will still trigger when opened.
Ways to stay protected
There are several ways in which you can protect yourself from such a crafty phishing scheme. The most obvious question is to ask yourself if you are expecting a document to be signed. If you aren’t, there is a good chance that the file is troublesome. Here are some ways to avoid falling victim:
Don’t click that link – Never click on links or open attachements found in unsolicited emails. They could be malicious and lead to tons of problems.Scrutinize the sender’s email address – Look for anything out of the ordinary like small typos or spelling mistakes.Use trusted antivirus software – This will help protect against malicious files and websites. We recommend our sponsor, TotalAV. TotalAV has an exclusive deal for Kim’s readers: $100 off for real-time antivirus protection. That’s an entire year for just $19. Tap or click here to sign up.
Keep reading
Is it safe to store financial documents and personal files in the cloud? Practical tech tip: How to digitize your most important documents
