DocuSign Lure Concealing Malicious Link in Remittance-Advice PDF Body

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•2

Detects phishing emails masquerading as legitimate DocuSign remittance advice notifications. The rule identifies emails containing specific keywords related to PDF sharing or remittance advice originating from 'docusign' and featuring suspicious, alternating-case hyperlinks often used in credential phishing campaigns.