Phishing Campaign Chains DocuSign and Adobe Themes With Browser-in-the-Browser Credential Theft
Summary
Barracuda Research describes a phishing campaign that uses a personalized DocuSign lure, CAPTCHA gating and an Adobe-themed prompt before a fake in-page Microsoft sign-in window harvests credentials.
Key points
- The campaign begins with a personalized DocuSign-themed email asking recipients to review and sign a document.
- A CAPTCHA gate may keep automated scanners and sandboxes from reaching the phishing page.
- An Adobe Acrobat-themed prompt frames Microsoft authentication as routine access to a shared document.
- The final browser-in-the-browser page imitates a Microsoft login popup, but its displayed address bar is part of the attacker-controlled webpage; submitted credentials go to attacker infrastructure.
- Researchers observed victim-specific personalization, redirect chains, embedded analytics and reusable landing-page patterns, suggesting a maintained phishing platform.
- Recommended defenses include monitoring suspicious sender and authentication behavior, reviewing third-party app consent, and using phishing-resistant authentication such as passkeys or FIDO2 keys.
Article Details
- Attack Vectors
- A personalized DocuSign-themed email prompts the recipient to review and sign a document.
- A CAPTCHA gate filters automated security scanners before redirecting the visitor through a multi-stage phishing flow.
- An Adobe Acrobat-themed dialog presents Microsoft authentication as necessary to access a shared document.
- A browser-in-the-browser page imitates a Microsoft sign-in window using HTML, CSS, and JavaScript; credentials entered are submitted to attacker infrastructure.
- Defensive Notes
- Monitor for sender display names containing the recipient organization’s domain, DocuSign-themed messages that fail authentication checks, HTML-only messages with a single call to action, and repeated document-review lures from unfamiliar senders.
- Review third-party application consent activity, monitor suspicious authentication after phishing alerts, and restrict application consent where appropriate.
- Enforce DMARC, SPF, and DKIM; use phishing-resistant authentication such as passkeys or FIDO2 security keys where possible; and inspect redirect chains.
- Combine layered email security with web, identity, and endpoint protections, and train users that a simulated browser popup remains confined within the webpage.
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe browser-in-the-browser sign-in form captures credentials and submits them to attacker infrastructure rather than Microsoft.T1497.001 · System ChecksThe CAPTCHA gate is designed to prevent automated security scanners, crawlers, and sandbox environments from reaching the final phishing page.T1566.002 · Spearphishing LinkThe campaign begins with a personalized DocuSign-themed email containing a link to the phishing flow.
Products
Adobe Acrobat ReaderAfter the CAPTCHA, the victim sees a fake Adobe Acrobat Reader consent dialog overlaid on a blurred background document.DocuSignThe attackers combined DocuSign impersonation, victim-specific branding, CAPTCHA-based evasion, an Adobe Acrobat-themed authentication prompt, and a BitB credential-harvesting page.Google ChromeThe address bar and Chrome window are part of the page design.