DOCUSIGN IMPERSONATION - REMOTE ACCESS

Docusign said "Update Required." The download was a remote-control tool.

Check Point Research named two lookalike Docusign domains in its Q3 2026 brand phishing report. We went and looked at both of them, and neither one is serving the scam any more. That is the trap, not the good news.

SB

SafeBrowz Threat Research Security Research · 24 October 2026 · 13 min read

What the page actually did

Check Point Research published its Q3 2026 brand phishing report on 16 October 2026, and buried in it is a campaign that deserves more attention than the headline figure it sat under. The headline was that Microsoft now accounts for 33 percent of all brand impersonation attempts the firm tracked, up from 23 percent in the previous quarter. The campaign underneath it is quieter and, for anyone who signs documents for a living, more dangerous.

A set of websites impersonating Docusign began being registered in September 2026, and the registrations continued into early October. Check Point describes an active one as showing what looks like a document waiting for review and signature, with an "Update Required" prompt on top of it claiming that a Docusign Reader update is needed before the document will open. Pressing Continue downloads a file Check Point names as fleetdeck_installer.

FleetDeck, at fleetdeck.io, is a real remote monitoring and management product. It is the kind of software an IT department installs on the machines it looks after so it can reach them later without walking over. Check Point's reading is that distributing it through a spoofed Docusign site suggests the goal is unauthorised remote access to the victim's device, and that reading is hard to argue with. Nothing about a document you were sent requires remote management software on your laptop.

Docusign had already warned about this shape. A fraud alert on its Trust Center dated 20 August 2026, two months before the Check Point report, describes attackers sending envelopes containing a blurred document preview with a button offering to "unblur" or "view" it, alongside prompts that mimic Adobe Acrobat or other software and ask the recipient to download a tool to see the content. The campaign in this post is the same idea with Docusign's own branding on the update prompt instead of Adobe's.

Notice what is missing from that chain. There is no password field. There is no fake Microsoft 365 sign-in, which is what the more familiar Docusign signature-request phishing email builds toward. The attacker here is not trying to borrow your account. They are asking for the whole computer, and they are asking politely, in the voice of a software updater.

Both domains, checked on 24 October

The report names the first domain of the set as docusigninstalleradmin[.]help and gives docusignsinstaller[.]help as an example of the ones that followed. It does not publish per-domain registration dates, so the day-level dates further down are from our own lookups. We checked both hosts rather than treating the write-up as the current state of the world, and the result is the most useful thing in this post.

Neither of them is serving the fake Docusign page today.

docusigninstalleradmin[.]help answers HTTP 200 with a page whose title is "Redirecting..." and whose visible content is the word Loading and three blinking dots. Underneath that is a script carrying a base64-encoded configuration block, and when you decode it, the page describes itself: it labels the domain with a tenant value of "namesilo-parked" and posts a bundle of visitor details to a domain-monetisation router. The details it collects are worth listing, because they are more than a parking page needs to pick an advert: whether an ad blocker is present, whether the browser reports itself as automated, whether the page is inside a frame, the referring page, the browser's timezone and its offset, and the vendor string of the graphics adapter. That last one is a reasonable way to tell a real laptop from a virtual machine.

We want to be precise about whose fingerprinting that is, because getting this wrong is easy. The configuration self-identifies as parked, the collection endpoint belongs to a domain-monetisation platform whose own domain has been registered since 2007, and the registrar whose name appears in the tenant string is the same registrar the domain was registered through. We could not independently confirm the commercial relationship between the two companies, only what the page's own configuration states. So the honest conclusion is that this is a parking and monetisation page doing the profiling, not proof that the phishing operator is still watching. Attributing a shared service's behaviour to the attacker who once used the domain would be a mistake, and it is the same mistake as reading a shared hosting address as the publisher's own server.

docusignsinstaller[.]help, registered on 1 October 2026, is in a different state. It redirects to a suspended-page path and renders the hosting provider's "Account Suspended" notice. Somebody complained, or the host noticed. The hosting is gone.

Two details link the pair, and this is our own observation rather than something the report states. Both were registered through the same registrar, and both sit on the same pair of Cloudflare nameservers, 26 days apart. That is consistent with one operator working through a set rather than two unrelated people picking the same idea. It is not proof of identity, because a nameserver pair is assigned rather than chosen, but a matching registrar and a matching pair is a thin coincidence.

The third detail is the one that matters to you. Both domains are still registered, one until September 2027 and one until October 2027, and both still resolve through the same nameservers. Nothing has been taken away from whoever holds them. A suspended host can be replaced in an afternoon, and a parked domain can be pointed back at a landing page just as fast.

Why "I clicked it and nothing happened" proves nothing

This is the reason we wrote the section above out in full rather than summarising it. When a warning about a scam domain reaches you, there is a natural and sensible instinct to go and check the domain yourself. On the day you do that, the odds are good that you will find exactly what we found: a blank loading page, a parked advertising page, a hosting notice, or a server error. None of those looks threatening, and none of them is the page the warning was about. The conclusion that follows feels reasonable and is wrong.

We can put a number on how fast this moves, because it moved while this post was being written. The parking page described above was what the first domain served when we looked in the morning of 24 October 2026. By the afternoon the same host had stopped answering properly altogether and was returning a server error through its content network instead. Same domain, same registration, same nameservers, three different harmless-looking responses inside one day. Whatever it shows you on the day you check is a snapshot of that hour, nothing more.

A warning is a record of what a host was serving when somebody looked. A page is a record of what the host is serving in the second you ask. Phishing infrastructure is rented, rotated and recycled, so those two things disagree more often than they agree. The campaign's active window is usually days, and the write-up that tells you about it is usually weeks. By the time the advice is public, the page is somewhere else.

This has a practical consequence. If you clicked a link like this while it was live, what the domain shows now tells you nothing about what reached your machine then. Work from what you did, not from what the page does today. The same applies in the other direction: a domain that looks dead is not a domain that is safe, which is exactly why we keep an entry for a host that has gone quiet rather than clearing it out. Dormant infrastructure gets reused, and the entry is what protects somebody if it comes back.

The file was not a virus, and that was the point

The second thing this campaign gets right, from the attacker's side, is the payload. FleetDeck is legitimate software from a real company, and its domain has been registered since 2018. It is not malware, it has no reason to be flagged as malware, and treating it as malware would be unfair to its publisher and useless to its customers.

Which means the question most people reach for, is this file a virus, returns the answer no. The file is fine. The installation is fine. What is not fine is who asked for it and why, and that is a question about context rather than about the bytes on disk. We have seen this exact shape before in a campaign that shipped a genuine, properly signed program as the first stage of its chain, and the lesson generalises: once an attacker works out that the defender is checking the file, the obvious move is to send a file that passes.

Remote management tools are attractive to an attacker for reasons that have nothing to do with stealth. They are designed to be installed quickly by a non-expert, to run as a background service, to survive reboots, and to give a remote operator a full interactive session. An attacker who talks you into installing one has not stolen a credential they then have to use carefully. They are sitting at your desk, in your already-authenticated sessions, with your saved passwords and your approved devices. Two-factor authentication does not help, because nobody is logging in. The same end state is what the certificate-expiry calls that talk people into installing AnyDesk are aiming for, and what a fake bank email carrying remote access delivers by attachment instead.

This one never asks for your password

Most of the advice people have absorbed about phishing is advice about login pages. Check the address bar before you type your password. Look for the padlock. Make sure the domain is the real one before you sign in. It is good advice and it is aimed at the right place, because most phishing is still credential theft.

It does nothing here, and the reason is structural. You never type a password, so the moment the advice is attached to never arrives. The page is a document viewer that needs an update, and the mental model you bring to a software update is completely different from the one you bring to a sign-in form. An update prompt is annoying rather than suspicious. It is the thing you click through to get to the thing you wanted. The whole design of this lure is to borrow that reflex.

Two other defences also miss. A visual check of the page comes back clean, because the page is not pretending to be a login screen and has no stolen branding to get subtly wrong. And a check of how old the domain is only helps if you make it: both of these were weeks old when they were active, which is a real signal, but it is one you have to go and look up rather than one the page volunteers. The phishing page we found on a seven-year-old domain shows what happens when even that signal is unavailable.

What does transfer is the habit underneath the login advice: read the domain, and read it before you do anything the page asks. "docusign" followed by extra words, on a top-level domain Docusign does not use, is wrong whether the page is asking for a password or an install.

What a genuine Docusign request looks like

This is worth knowing precisely, because the real version is specific enough to check in a few seconds.

• Docusign's fraud resources page states that envelope email notifications are always sent from the docusign.net domain. Envelope links live on the same domain, with a regional prefix such as na2, na3, na4, eu, ca, au or jp, so a genuine link looks like www.na2.docusign.net rather than anything else.
• Most envelope notifications carry a 32-character security code, printed in the bottom section of the email under the heading "Alternate Signing Method".
• If you are unsure about an envelope, Docusign tells you to reach it through the Access Documents feature rather than the email's button. Type docusign.com into a fresh tab yourself, use Access Documents, and enter the code. A real request is waiting for you there. A fake one is not.
• Suspicious emails go to [email protected], forwarded as an attachment. Docusign describes an automatic acknowledgement followed by a reply, typically within about two hours, telling you whether the content is legitimate or suspicious.
• Nothing in that sequence involves a download, and Docusign states that plainly. A fraud alert on its own Trust Center dated 20 August 2026 reads: "Docusign will never require you to download software or 'unblurring' tools to view a document. If prompted to do so, stop immediately." That is the company's own position, not an inference, and it is the shortest answer to the prompt this campaign shows you.

Block a fake document page before you install anything

Both of the domains Check Point named are on our block list as of 24 October 2026, with the campaign, the source and the date recorded against each one, and you can click the red domains above to see that verdict for yourself. We added them even though one is parked and one is suspended, because a domain that still has two years on its registration and a working nameserver pair has not been taken away from anyone.

We want to be straight about why those entries were needed, because it is the more useful thing to know. Our domain rules did not catch either of these two on their own. The hostnames here run the brand name straight into the next word with no separator, "docusign" followed immediately by "installeradmin", and they sit on a top-level domain we do not treat as high-risk. A hyphenated or subdomain-style lookalike is a different matter, and that is the form our domain checks are built around. A run-on label on an ordinary top-level domain is not, which is exactly why the two specific hosts are listed by name rather than left to a rule.

That distinction matters to you more than it does to us. The hostname is the one part of a page that cannot change between the moment you are sent a link and the moment you open it, so it is still the thing worth reading first. It just means the reading is yours to do, and "docusign" with extra words glued on, on a top-level domain Docusign does not use, is the thing to notice.

What does generalise across this family is the content read, which is where a page pushing an installer under a brand that does not own the domain beneath it gets judged on what it is asking for rather than on its hostname. That is the layer doing the work on a fake meeting-client update and on the verification prompts that ask you to run a command. We are describing where it is aimed, not promising it fires on every variant of this one.

Where this stops, honestly: the .help top-level domain is not on our high-risk list and we are not going to add it, because legitimate support and documentation sites use it and the false positives would land on real businesses. And a lookalike that drops the brand name out of the hostname entirely, the way a fake Teams join page did earlier this month, gets past the domain layer completely and has to be caught some other way. Nobody's domain rules catch everything, and a tool that implies otherwise is selling you something.

Four checks before you open a document link

1. Read the domain, not the document. A real Docusign envelope link is on docusign.net, usually with a regional prefix. If the host is anything else, the document on it is a picture of a document.
2. Treat any install prompt as the end of the road. Documents do not need readers in 2026. A prompt to install something before a file will open is the scam, whatever the file is called and however legitimate the software turns out to be.
3. Go round the email. Use the 32-character code from the "Alternate Signing Method" section at docusign.com, in a tab you opened yourself. If nothing is waiting, you have your answer without touching the link.
4. Check who actually sent it. If the document claims to come from a colleague or a client, contact them on a number or address you already had, not one from the email. For a general method, see how to tell whether a sender address is real.

If you already ran the installer

Move in this order, and do not spend time first working out how serious it is.

• Disconnect the machine from the network. An interactive remote session ends when the connection does.
• If the computer belongs to an employer, stop here and call IT or security. They will want the machine in the state it is in, and anything you remove is evidence they lose.
• From a different device, change the passwords for email first, then banking, then anything else you signed into on that machine, and use the sign-out-everywhere option wherever a service offers one.
• On a personal machine, look through installed programs and running services for remote monitoring software and remove it. It is built to persist through a restart, so a reboot proves nothing.
• Watch for sign-ins from places you have not been, and for a small test charge on any card stored in a browser on that machine.
• Report it. In the United States that is the FBI's IC3 at ic3.gov. In England, Wales or Northern Ireland it is reportfraud.police.uk; if you live in Scotland, that service tells you to report via 101 instead. Forward the original email to [email protected] as an attachment so Docusign can pursue the takedown. If money has moved, the recovery steps in order are worth following properly.

Add to Chrome Add to Firefox Add to Edge Get it on Google Play