Kali365 / EvilTokens - Hardcoded Subject Lines (DocuSign/SharePoint Phish)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•2•0•12

Detects phishing emails utilizing Kali365's hardcoded subject line templates impersonating file sharing services like SharePoint and DocuSign. The rule specifically looks for emails with subjects starting with "SharePoint - Document Shared:" or "DocuSign - Signature Required:" where the sender's domain is not microsoft.com or docusign.com, indicating a potential spoofing attempt.