Counterfeit DocuSign remittance-advice PDF lure with embedded link

Arnold Chan@slaz

•updated Aug 27, 2026•0•0•1

Detects malicious PDF attachments that masquerade as DocuSign remittance advice notifications. These PDFs contain embedded hyperlinks (via /URI or /Link action annotations) designed to redirect users to malicious external sites rather than legitimate DocuSign services, commonly used in phishing campaigns.