DocuSign-themed spearphishing lure: Remittance Advice PDF share

Arnold Chan@slaz

•updated Aug 27, 2026•4•0•10

Detects incoming emails that impersonate DocuSign notifications, specifically looking for typical phishing lures involving 'Remittance Advice' and a call-to-action to 'Tap here to view document'. This rule identifies emails using common social engineering tactics to harvest credentials or distribute malware via fake document links.