Thirtyseven4 Security: Docusign Inspired Scam
The last thing that a responsible adult does is ignore an official legal notice citing necessary action to be taken.
Ignoring flashing police lights in our rearview mirror, skipping jury duty, or deleting an official legal notice from our inbox are all things that can have severe (personal and judicial) ramifications, and no one desires a default judgment against them or a citation by their legal record.
And so: reason, logic, and law tell us to: Pull over when there are flashing lights driving behind us.
Show up when assigned to be a juror in jury duty.
And open and sign an official online document when we are served with one in our inbox.
Right?
Well, first of all, let’s acknowledge that our first response to any legal or official summons is often to freak out a bit. Our blood pressure rises, and our heart skips a beat when we are pulled over by a police officer or if we receive something official in our inbox.
But—before we react…verify. Is it official?
Not the cop in our rearview, but is the unsolicited email legit?
After remaining calm, our next course of action is prudence when receiving unsolicited (legal/business/judicial/banking/governmental/etc.) documents via email or social media. Proceed with caution and verify, verify, verify.
Verify the email address that has “notified” you. (Hover over the address to see the full listing and to investigate its validity. Place the message in a “junk” email folder to open up full listing addresses and links. What do you see?)
Think. If the sender or web listing is suspicious in any way, dig deeper before responding with any personal information or data.
Read. Are there any misspellings (at all) within the body of the “official letter” that we have received? Misspelled words are a red-flag in any “official” document.
The Thirtyseven4 Security ThreatLab has detected a significant uptick in cybercriminals creating fraudulent emails masquerading as lawsuits, jury-duty notices, case filings, and other legal documents that have been socially-engineered to appear authentic but that lead to fake (and malicious) websites. These phishing scams are designed to (legally/civically/professionally) coerce users to respond to an “official” document by entering/sharing personal data and information to cyber attackers.
Below is a real time (earlier this week) example of a phishing email sent to a harvested email account and appearing as an intimidating and urgent ‘Potential Lawsuit Notice’ sent from Docusign, a legitimate American software company headquartered in San Francisco that manages electronic agreements and signatures.
But: Verify! Think! Read! Is it a legitimate email?
As is the case with most phishing emails, the purpose of the email is credential extraction.
The link in the email is asking for a password with the pre-populated email address ‘sales@thirtyseven4.com’ when trying to perform actions like document download or sign-in.
When a random password is entered, it gives the error message ‘Failed to open document. Please try again’. Meanwhile in the background, the credentials you’ve entered have been relayed to the cyber-criminal.
To avoid falling victim to such scams, the Thirtyseven4 EDR Security ThreatLab advises exercising extreme caution with any unsolicited emails or phone calls that you might receive in relation to legal documentation. Thirtyseven4 recommends heightened awareness, caution, and even suspicion in relation to calls or emails from any individual asking (pressuring) for money or (financial/personal) information (no matter who they claim to be).
In most cases, the scammer will attempt to create a sense of urgency in order to act/react quickly with immediacy. As with any unsolicited call or email, never provide highly sensitive personal information such as social security numbers, passwords, credit card details, or banking information.
A responsible adult will always pull over if a police car indicates to do so, but Thirtyseven4 Security reminds responsible online adults to verify, think, read, and be proactive in protecting themselves against cyber criminals and intimidating phishing scams.
Trust us to protect you.
About Thirtyseven4 EDR Security:
Thirtyseven4 EDR Security exceeds cyber security insurance requirements and includes:
- Endpoint Threat Hunting
- MISP Integration
- Access Controllers
- BitLocker Encryption Management for Data Security
- User Behavior Analysis
- Advanced EDR Capabilities
- A.I. based Ransomware Protection
- Next-Generation Malware Engine
- Automated Curative Response
- Automated/Monitored/Dynamic Endpoint Detection & Response (EDR) functionality
- Removal of Current Antivirus Product
- Integrated Patch Management
- Anti-Keylogger modules
- Asset Management
- Firewall
- PC-Tuning
- Content Filtering
- Malware Detection & Removal
- Vulnerability Scanning
- Email Security
- Advanced Device Control
If interested in receiving a no-obligation quote for Thirtyseven4 EDR Security, please complete the form located at:
https://www.thirtyseven4.com/get-a-quote/
A leader in Educational cyber security, Thirtyseven4 Security protects over 2400 schools, businesses and non-profits across the Nation.
Thirtyseven4, LLC is dedicated to serving customers with a full palette of security solutions including AntiVirus, AntiMalware, Anti-Ransomware and Zero-Day Threat Protection.