DocuSign has observed a new phishing campaign that began the morning of July 18th (Pacific Time).

The email comes from “Carl Evans” using the email address dse@novusimaging.com with the subject “Your document Leasing Contract 123 for <recipient_domain> is ready for signature” and it contains a link to a malicious, macro-enabled Word document. This email is not sent from DocuSign. Do not click the link in this email, instead please forward it to spam@docusign.com and then delete the email immediately. 

For more information on how to spot phishing please see our Combating Phishing white paper (3.3 MB).