NFe-themed ZIP download tied to cloned DocuSign phishing infrastructure

Arnold Chan@slaz

•updated Sep 9, 2026•1•0•3

Detects the download of ZIP files with filenames matching known phishing patterns associated with NFe (Nota Fiscal Eletrônica) campaigns, correlated with access to specific malicious or suspicious download URLs within a 15-minute window.