DocuSign has observed a new phishing campaign that began the morning of June 12 (Pacific Time).

The email comes from William Scott “william_scott@flexovitportal.com” with the subject “Please review your document Invoice <1234567> for <recipientdomain.com>” and it contains a link to a malicious, macro-enabled Word document. Do not click the link in this email, instead please forward it to spam@docusign.com and then delete the email immediately. For more information on how to spot phishing please see our Combating Phishing white paper (3.3 MB).