PhishingReviewed
Fake DocuSign proposal emails deliver eD0cuSign_Installer.msi from webdocusign.viewportal.es to hijack PCs
MalwareTips, citing Huntress, reported on 1 November 2026 that fake DocuSign proposal emails deliver eD0cuSign_Installer.msi from webdocusign.viewportal.es, enrolling PCs in device management and bringing back remote access after removal.
- webdocusign.viewportal.es
- Installer file eD0cuSign_Installer.msi; abuses Hexnode device management and ScreenConnect (documented by Huntress)
Reported Nov 1, 20261 report