{
  "name": "From E-Sign to RMM: DocuSign Kit Targets Windows and...",
  "slug": "from-e-sign-to-rmm-docusign-kit-targets-windows-and",
  "description": "A sophisticated phishing campaign leverages DocuSign-themed lures to trick victims into installing legitimate remote management software including MeshAgent, ScreenConnect, and SimpleHelp. The operation employs a reusable web kit featuring staged delivery through simulated document loading interfaces, user-agent based targeting that filters for Windows systems while blocking Edge browsers, and Cloudflare Turnstile verification. The campaign demonstrates operational maturity with separate Windows and macOS delivery paths, real-time victim telemetry via Telegram, and VBS deployment scripts that disable Windows Defender and establish persistence through service installation. Active from May through July 2026, the infrastructure rotates across multiple domains using consistent URL patterns to evade detection while abusing trusted IT tools for persistent access.",
  "published": "2026-07-21T11:38:33.966000+00:00",
  "created_at": "2026-07-21T22:17:08.075000+00:00",
  "modified_at": null,
  "created_at_opencti": null,
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "cloudflare turnstile",
    "docusign phishing",
    "macos targeting",
    "meshagent",
    "rmm abuse",
    "screenconnect",
    "simplehelp",
    "uemsagent",
    "vbs deployment",
    "windows defender evasion"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "523c5822-6cf7-4b00-a426-9a31fe44ae14",
        "name": "https://spearbit.com/meshagents?..."
      },
      {
        "id": "7df3d182-dfa9-48bf-b7e0-7bebe274fbcf",
        "name": "https://spearbit.com/license/check.php?..."
      },
      {
        "id": "1ed3204a-3e2e-456a-8c81-7ee6c173b921",
        "name": "https://rosetomaz.com.br/it/"
      },
      {
        "id": "75e10752-ebdd-4428-a9e2-c740be9a4b6a",
        "name": "rosetomaz.com.br"
      },
      {
        "id": "303581f2-5ad2-4fc8-aae6-f89f2cee88dd",
        "name": "2a206b085fedf8b20d1db883814c15e0202617da223dbb4e28b7109df98645df"
      },
      {
        "id": "c3b11a0a-3fb6-4015-b76b-6111a750b16d",
        "name": "magroys.lat"
      },
      {
        "id": "5b8168c9-260e-4eb9-b37e-42b45e1f84db",
        "name": "4f1c8de304a855c2a4d1995b41069641dee84f1b51b6fb4a6e24eee59c6a30e4"
      },
      {
        "id": "388c339b-d66b-414f-9a8b-43b10b85d6eb",
        "name": "i8reactorsee.xyz"
      }
    ],
    "attack_patterns": [
      {
        "id": "eaff4611-3c78-4127-8745-726f77ed68ba",
        "name": "T1070.004"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "d048ac4b-dd28-4c66-b62b-fe25cefef481",
        "name": "T1548.002"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "c12e0e03-aab0-4646-a929-e921a3d27f02",
        "name": "T1219"
      },
      {
        "id": "9e784d22-5a6c-4da6-968a-5fab2f019efd",
        "name": "T1059.005"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "7364ca96-72bf-4b7f-afef-ce2583b1ed58",
        "name": "T1562.001"
      },
      {
        "id": "b15c00da-c412-4429-900c-659de612baf5",
        "name": "T1543.003"
      }
    ],
    "malware": [
      {
        "id": "d68cc3cf-dcf2-4302-b3b2-eac576b155ba",
        "name": "UEMSAgent"
      },
      {
        "id": "7c311933-d077-46d3-b7ef-39420d74749b",
        "name": "SimpleHelp",
        "slug": "simplehelp"
      },
      {
        "id": "b9a94179-fee8-4a2e-bcfb-ce9c0dd34433",
        "name": "ScreenConnect",
        "slug": "screenconnect"
      },
      {
        "id": "6a818800-6131-4716-908a-8e1fcc2085d2",
        "name": "MeshAgent",
        "slug": "meshagent"
      }
    ],
    "observables": [
      {
        "id": "569c1216-7486-4284-8786-8ade326a924e",
        "name": "magroys.lat"
      },
      {
        "id": "0f6f0f8b-2ae1-41ac-be21-7eae532d6c4d",
        "name": "i8reactorsee.xyz"
      },
      {
        "id": "bad73dbb-a8d1-49c3-ac40-f372cba7768f",
        "name": "rosetomaz.com.br"
      },
      {
        "id": "742c7a9f-1342-4e23-a34b-1d5603ec8687",
        "name": "https://spearbit.com/meshagents?..."
      },
      {
        "id": "64442984-9cf2-47f3-a4f0-de8bd3a43845",
        "name": "https://spearbit.com/license/check.php?..."
      },
      {
        "id": "4c06bfa9-8418-4e5b-b382-ca50325f715a",
        "name": "https://rosetomaz.com.br/it/"
      }
    ]
  },
  "external_refs": [
    {
      "id": "0de9080e-7ae3-400f-929d-97a145ed6cd4",
      "standard_id": "external-reference--2a885b35-9c95-5817-80e7-66f0c91d1801",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a5f5a391cc670d0388a1d29",
      "hash": null,
      "external_id": "6a5f5a391cc670d0388a1d29",
      "created": "2026-07-21T22:17:04.925Z",
      "modified": "2026-07-21T22:17:04.925Z",
      "createdById": null
    },
    {
      "id": "b84664f8-ec44-4ffc-97d4-1e5f2451a6e9",
      "standard_id": "external-reference--2ef6c5e5-74b0-5dc4-9134-5eceb2f71948",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.bluevoyant.com/blog/docusign-phishing-kit-rmm-analysis",
      "hash": null,
      "external_id": null,
      "created": "2026-07-21T22:17:04.953Z",
      "modified": "2026-07-21T22:17:04.953Z",
      "createdById": null
    }
  ]
}