Fake DocuSign proposal emails deliver eD0cuSign_Installer.msi from webdocusign.viewportal.es to hijack PCs
MalwareTips, citing Huntress, reported on 1 November 2026 that fake DocuSign proposal emails deliver eD0cuSign_Installer.msi from webdocusign.viewportal.es, enrolling PCs in device management and bringing back remote access after removal.
- First reported
- Reports
- 1
Source: malwaretips.com · published
What happened
MalwareTips reported on 1 November 2026 on a fake DocuSign proposal email scam documented by incident responders at the security firm Huntress. According to the report, business-themed proposal emails link to a download at webdocusign.viewportal.es that delivers a misleadingly named installer package, eD0cuSign_Installer.msi. The installer added Hexnode device-management components, which put the Windows computer under the control of an outside organisation. DocuSign, Hexnode and ScreenConnect are legitimate products; MalwareTips stresses they are being misused here, and none of the companies is involved in the scam.
How the scam works
The report says ScreenConnect remote access then appeared on the computer. After it was removed it came back, because the management software gave the attacker a way to install it again. This is why simply removing the remote-support app that you can see may not end the problem. Device-management software exists so that real employers can configure devices, apply policies and distribute approved applications, and its usefulness comes from the authority it receives over those devices. When someone tricks a user into installing a management agent for their own environment, those ordinary abilities can serve the attacker's instructions.
MalwareTips explains that a proposal email works as a lure because business inboxes are full of genuine bids, contracts and meeting requests, and downloading something feels like progress. An MSI file is a Windows installation package that can add programs and settings to the machine, so it is not simply another way of viewing a document. A signature on the software identifies its publisher, not who is directing it, which is why the check has to include the management service and whether your real administrator authorised the connection.
Its advice is not to run an installer to view a document, to contact IT if one was run, and to remember that removing the visible remote-support app may not remove the management connection. Changing an email password is still worthwhile if exposed, but it does not automatically remove a device from an unauthorised management environment.
Source
MalwareTips, “Fake DocuSign Proposal Scam: The Installer That Keeps Remote Access Alive”, 1 November 2026, citing documentation by Huntress.
Red flags
- A proposal email that links to an installer file instead of a document, such as eD0cuSign_Installer.msi.
- A download from a lookalike address like webdocusign.viewportal.es instead of DocuSign's own domain.
- A file name mixing a brand name with odd letters or digits.
- A remote-support tool that appears unexpectedly, or returns after you remove it.
- Being asked to install software just to review a document.
If you were targeted
- 1Do not run installers sent in proposal or document-signing emails; open documents through the service's official site.
- 2If you ran one, contact your IT team or a security professional straight away and disconnect the computer.
- 3Remember that removing the visible remote-support app may not remove the management connection.
- 4Check which organisation, if any, manages your device, and whether your administrator authorised it.
- 5Confirm unexpected proposals with the sender through a different, established channel.