Kaspersky has identified an ongoing phishing campaign that impersonates official emails from Zoom and Docusign, targeting corporate accounts across various regions, including the Middle East, Latin America, and Western Europe. This revelation highlights the persistence of traditional phishing tactics, even as more sophisticated scams emerge, according to a report by Tahawul Tech.
The campaign began with attackers sending emails that appeared to be legitimate communications from Docusign, aimed at corporate users. These emails contained phishing links designed to capture sensitive credentials. A follow-up wave of emails, which continues to be active, masquerades as notifications from Zoom, warning users that their accounts may be disabled. This second wave employs simple yet effective tactics, including links that redirect to credential-stealing sites and forms requesting personal and financial information.
As of September 2026, Kaspersky has detected over a thousand phishing emails associated with this campaign. Andrey Kovtun, the Email Threats Protection Group Manager at Kaspersky, noted that while the technology landscape is rapidly evolving, basic phishing methods remain effective. He emphasized that employees might overlook phishing signs amidst the high volume of emails they receive, making it crucial for companies to implement robust security measures.
Kaspersky recommends several strategies to enhance corporate email security:
- Implement dedicated security solutions like Kaspersky Security for Mail Server, which can protect against both traditional and modern phishing attempts.
- Provide security training for employees to improve their awareness of cyber threats and reduce the risk of human error.
- Adopt an integrated defense strategy that combines endpoint protection with measures to mitigate human risk. For smaller businesses, Kaspersky Small Office Security Premium offers features to block phishing attempts and educate staff.
- Regularly update employees on potential cyber threats and the characteristics of malicious emails.
- Conduct controlled phishing simulations to assess employee vigilance and identify those at higher risk.
- Utilize multi-factor authentication (MFA) for all email accounts, particularly for privileged users, and consider password-less options where feasible.
This ongoing phishing campaign serves as a reminder of the importance of vigilance and proactive measures in safeguarding corporate email systems against evolving cyber threats.
Follow our Tech news coverage for related developments.
