DocuSign has observed a new phishing campaign that appears to be financially motivated, and may also hope to install malware.

The emails have been addressed to "Dear Recipient," and purport to come from "DocuSign Signature and Invoice" using a variety of email addresses with domains appearing to be registered for lawsuits such as  @cellucorc4lawsuit[.]com, @accuraaccelertionproblem[.]com, @goodwilllawsuit[.]com and @officedepot-lawsuit[.]com.

The emails have been observed to have subject lines:"You received notification from DocuSign" or "You got invoice from DocuSign." These emails contain links to Google docs, which contain further links to compromised sites.

These emails are not sent from DocuSign. Do not click on the link in these emails, instead please forward them to spam@docusign.com and then delete the email immediately.

For more information on how to spot phishing, please see our Combating Phishing white paper.