Kaspersky experts identified a phishing campaign targeting corporate email addresses using fake notifications from Zoom and Docusign. The attackers aim to steal user credentials, personal information, and banking details. As of September 2026, over 1,000 such messages have been detected globally, including in Russia.
The campaign consists of two distinct waves. The first wave impersonated Docusign, targeting users in Russia, Armenia, Azerbaijan, the Middle East, Latin America, and Western Europe with links designed to harvest login credentials. The second wave, which remains active, mimics Zoom notifications.
In the Zoom-themed attacks, users receive alerts about account blocks or new messages. These emails contain either phishing links leading to credential-harvesting pages or PDF attachments requesting personal data and credit card information. Kaspersky emphasizes that these methods exploit the high volume of corporate email traffic.
To mitigate these risks, Kaspersky recommends deploying specialized email security solutions and implementing multi-factor authentication for all accounts. The firm also advises businesses to conduct regular security awareness training, perform simulated phishing tests, and adopt passwordless authentication methods like push notifications or hardware tokens.
