Kaspersky has uncovered an ongoing phishing campaign impersonating DocuSign and Zoom emails, showing that cybercriminals continue to use simple social-engineering tactics to steal sensitive information.
The first wave targeted corporate accounts across the Middle East, Latin America, Western Europe, Russia, Armenia and Azerbaijan, with emails posing as official DocuSign communications and containing links designed to steal user credentials.
More than a week later, attackers launched a second wave impersonating Zoom notifications. The emails warned recipients that their accounts were about to be disabled and used two primary methods: links leading to credential-stealing websites and embedded forms requesting personal information and credit-card details.
Kaspersky said that more than 1,000 phishing emails had been detected as of September 11, with the campaign still active.
Andrey Kovtun, Email Threats Protection Group Manager at Kaspersky, said the campaign demonstrates that basic phishing techniques remain effective, particularly when attackers imitate widely used corporate brands.
To reduce the risk of email-based attacks, Kaspersky recommends deploying dedicated email security solutions, conducting employee security awareness training, regularly communicating phishing risks, testing employee readiness through controlled phishing campaigns, and implementing multi-factor authentication (MFA) across email accounts.
The company also recommends combining email protection with endpoint security and human-risk mitigation to provide multiple layers of defense against phishing attacks.
