{
  "name": "2025 Holiday Scams: Docusign Phishing Meets Loan Spam",
  "slug": "2025-holiday-scams-docusign-phishing-meets-loan-spam",
  "description": "During the holiday season, threat actors exploit overloaded inboxes and financial stress through two main patterns: Docusign-themed phishing for corporate credential harvesting and loan offer spam for personal data theft. The Docusign campaign uses spoofed emails with authentic-looking branding, redirecting through disposable hosting platforms to a credential harvesting page. The loan scams range from obvious 'Xmas loan' offers to sophisticated marketing-style emails, ultimately leading victims to a detailed identity theft questionnaire on christmasscheercash.com. Both scams utilize seasonal themes and mimic normal end-of-year workflows to increase effectiveness. Defensive measures include verifying sender domains, validating link destinations, and treating unsolicited loan offers as high risk.",
  "published": "2025-12-23T14:09:12+00:00",
  "created_at": "2025-12-23T14:09:12+00:00",
  "modified_at": "2025-12-23T16:50:11+00:00",
  "created_at_opencti": "2025-12-23T14:09:12+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-12-23",
    "credential harvesting",
    "docusign",
    "email security",
    "holiday-themed",
    "identity theft",
    "loan scams",
    "phishing"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "www.christmasscheercash.com"
      },
      {
        "id": "",
        "name": "http://track.trust-text.com/index.php/campaigns/xo229otmwcfc8/track-url/ce474wg53d927/c029686d838a3ad3d65826c7e7bddcf3b6e32062There"
      },
      {
        "id": "",
        "name": "http://www.christmasscheercash.com/?id=5FfbxodhySi_D1TNJ-PpNRzZGFRGN7K_peJxXJjmuIA.&subId=ce474wg53d927Hxxps://go.thepersonalfinanceguide.com/https://webr-db.global.ssl.fastly.net/qi/exc.htmlSender"
      }
    ],
    "attack_patterns": [
      {
        "id": "00430919-9257-403b-8a1b-958d4c3613aa",
        "name": "T1557"
      },
      {
        "id": "16e4fc82-7c0b-4d1a-b784-b804b4df26dc",
        "name": "T1204.001"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "804630c7-dda3-49df-9ac4-70bd1ad83e06",
        "name": "T1192"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "thepersonalfinanceguide.com"
      },
      {
        "id": "",
        "name": "christmasscheercash.com"
      },
      {
        "id": "",
        "name": "trust-text.com"
      },
      {
        "id": "",
        "name": "financier.com"
      },
      {
        "id": "",
        "name": "track.trust-text.com"
      },
      {
        "id": "",
        "name": "go.thepersonalfinanceguide.com"
      },
      {
        "id": "",
        "name": "jritech.shop"
      }
    ]
  },
  "external_refs": [
    "https://www.forcepoint.com/blog/x-labs/docusign-phishing-holiday-loan-spam",
    "https://otx.alienvault.com/pulse/694ab098b6e9cfd598b40867"
  ]
}