Adobe Sign/DocuSign lure with spoofed domain and brand impersonation

Arnold Chan@slaz

•updated Sep 23, 2026•0•0•1

Detects phishing emails that impersonate Adobe Acrobat Sign or DocuSign using invoice or RFP-themed lures. The rule identifies suspicious emails by checking for brand-related keywords in the subject and display name, identifying links that do not lead to legitimate signing domains, and identifying senders that are impersonating a brand or are newly seen in the environment.