E-Business
Kaspersky Warns Local Businesses of Active Docusign-themed Phishing Scams
Kaspersky is warning of a rising phishing scam involving fraudulent emails pretending to be from Docusign, a globally used e-signature platform.
Cyber attackers are sending these emails with links to fake websites where users are asked to enter a work login and password.
The Docusign phishing attack begins with an email that resembles legitimate communication from the service provider. Unlike other phishing schemes, the malicious actors generally do not bother to forge or mask the sender address given how genuine Docusign emails can originate from any address due to the customisation options available to Docusign customers.
Typically, the victim is notified that they must electronically sign a financial-related document, with the click through link included in the email received. In some instances, the phishers can also include a PDF attachment with a QR code inside.
The victim is prompted to open the attachment and scan this QR code, supposedly to access the document for signing, however in reality this leads to a phishing website intended to gather users’ credentials.
The tactics and quality of execution can vary from email to email. However, the core principle remains the same: phishers rely on the recipient not understanding how e-signing with Docusign actually works. The inattentive victim follows the link (or QR code) to the phishing page and enters their work login credentials, which go straight to the attackers.
Usernames and passwords harvested through successful phishing attacks are often compiled into databases sold on illicit dark web marketplaces and later used to attack organisations.
The whole purpose of Docusign is to make it as easy as possible for companies and individuals to exchange electronically-signed documents. Any additional steps or restrictions — such as creating an account, entering credentials, opening attachments, or using only a smartphone to sign — go against this principle.
Therefore, Docusign asks for none of this and strives to make the signing process as quick and simple as possible.
To protect against this Docusign phishing tactic or other scams that impersonate popular services, Kaspersky recommends the following:
- Have an understanding around how the genuine service works: For example, Docusign will never:
o Send a PDF attachment with a link to a document to be signed.
o Give you no choice but to scan a QR code. Docusign works on both mobile devices and computers, so a link is always provided to access the document – not a QR code.
o Require you to enter work login credentials.
o Force you to register with or log in to Docusign. After you sign the document, Docusign might suggest creating an account, but it’s entirely optional.
- Be cautious of links and attachments: Avoid clicking on any unexpected links or downloading attachments in unsolicited emails.
- Train employees: Companies should educate employees on how to recognise phishing attempts. Specialised training systems such as Kaspersky Automated Security Awareness Platform can be of help.
- Use security solutions: Filtering out suspicious and unwanted email at the gateway level with products such as Kaspersky Security for Mail Server prevents employees from being defrauded by socially engineered scams. Security solutions for endpoints relevant to the size of the organisation – such as Kaspersky Small Office Security or Kaspersky Next – will also secure from phishing redirects.
- Use multi-factor authentication: This measure adds an extra layer of protection for sensitive accounts and services.
“Phishers are increasingly using names of trusted services like Docusign. We advise all IT users both at work and at home to always verify the sender’s identity and avoid clicking on suspicious links. Companies should ensure their teams know how to identify phishing emails, while multi-factor authentication and email filtering solutions add an extra level of defence,” Roman Dedenok, a cybersecurity expert at Kaspersky, concludes.
Nigerian Senate, on Tuesday, passed for first reading a bill aimed at amending the Nigerian Data Protection Act of 2023.
The amendment seeks to compel major social media platforms—including Facebook, X (formerly Twitter), Instagram, WhatsApp, YouTube, TikTok, and other independent bloggers—to establish physical offices in Nigeria.
The bill is titled “A Bill for an Act to Amend the Nigerian Data Protection Act, 2023, Mandating the Establishment of Physical Offices within the Federal Republic of Nigeria by Social Media Platforms, and for Related Matters, 2025.”
It was introduced by Senator Ned Nwoko, a lawmaker from Delta State.
The bill not only mandates that the social media platforms set up physical offices in Nigeria, but also seeks to regulate bloggers operating in the country.
It proposes that bloggers must establish verifiable offices in any Nigerian capital city, maintain proper employee records, and join a recognised association based in Abuja.
During the Senate debate, Nwoko highlighted Nigeria’s significant digital presence, referencing a report from Global Web Index shared by Business Insider Africa.
With a population of over 200 million, Nigeria ranks second globally in social media engagement.
Nwoko argued that having local offices is long overdue, noting that the absence of such offices creates challenges, including limited local representation and difficulties for users and businesses to engage directly with these platforms.
The Senate President, Godswill Akpabio, acknowledged the potential benefits of having these social media platforms establish local offices, particularly in terms of improving regulatory oversight and ensuring compliance.
However, Akpabio urged caution regarding the regulation of bloggers, stressing the importance of protecting online expression.
“It’s beneficial to have an address, but bloggers are a bit different. The best approach is for the bill to go for a second reading, followed by a public hearing to provide more clarity,” Akpabio said.
He emphasised that the intent of the bill was not to suppress social media, but rather to improve taxation and record-keeping for digital platforms in Nigeria.
The Senate has also tasked the Committee on ICT and Cyber Security to conduct a thorough review of the bill and report its findings in two months.
Google said Tuesday it will acquire cloud security platform Wiz for $32 billion, citing the need for greater cybersecurity capacity as artificial intelligence embeds itself in technology infrastructure.
The all-cash deal brings Wiz into the Google Cloud operation, boosting the capacity of consumers to use “multiple clouds” and providing “an end-to-end security platform for customers, of all types and sizes, in the AI era,” the companies said in a joint press release.
The deepening influence of AI makes “cybersecurity increasingly important in defending against emergent risks and protecting national security,” the companies said.
The transaction, the largest ever sought by Google or parent Alphabet, will test President Donald Trump’s openness to large takeovers after resistance to such deals by the administration of Joe Biden.
Alphabet had been close to a Wiz takeover last summer, but the deal fell apart due in part to regulatory concerns, according to the Wall Street Journal.
Started in 2020 by Assaf Rappaport, co-founder and CEO, and a team who sold a previous venture to Microsoft, Wiz will continue to work and provide services to platform led by other tech giants including Amazon Web Services and Microsoft Azure.
Wiz is based in New York, with offices in Tel Aviv and three other US cities.
In a webcast after the deal was announced, Rappaport said the service “continuously scans an organization’s code and cloud environments, monitoring them in real time” to “prioritize the most critical risk based on real impact and blocks active threats.”
Dare Olufunmilayo, founder and CEO of Darey.io, has said that the reason for the establishment of a physical tech hub in Lagos is to expand on the digital talents they have started building especially pushing its artificial intelligent initiatives further.
Speaking at the launch of the hub, he described the moment as more than just the opening of a new office but the beginning of a transformative movement.
“Today is not just about celebrating a new office space; it is about launching a movement, a revolution in how we learn, build careers, and create opportunities in the tech ecosystem,” he stated.
The event’s theme, “Tech & Tea: Brewing Nigeria’s Technology Innovation Future,” reflects the belief that building a thriving digital economy requires the right mix of talent, innovation, and collaboration.
Olufunmilayo likened the process to brewing the perfect cup of tea, requiring the right mix of talent, innovation, and partnerships.
“Just like brewing the perfect tea, building a thriving digital economy requires the right ingredients: talent, innovation, and collaboration,” he noted.
He also acknowledged the critical role of various stakeholders, including the Nigerian government, tech leaders, and industry partners.
“None of this would be possible without the ecosystem we are a part of. The government’s 3MTT initiative is playing a crucial role in creating a future-ready workforce,” he said, recognizing the contributions of government efforts, partners, and the dedicated Darey.io team.
Reflecting on the journey that led to this milestone, Olufunmilayo highlighted the company’s mission to empower Africans with world-class digital skills and bridge the gap between talent and opportunity.
“A few years ago, we started with a bold vision: to empower Africans with world-class digital skills and bridge the gap between talent and opportunity.
“We believed that, with the right platform, the right training, and the right mindset, anyone—no matter their background—could go from learning to earning in the global digital economy.”
That vision, he emphasized, has now become a reality. “Thousands of Nigerians have started their careers through Darey.io, working for top global companies, launching startups, and creating ground-breaking solutions.”
With the launch of Xterns.ai, the initiative is taking an even greater leap forward. “Xterns.ai is our next big leap—where we don’t just train talents; we integrate them directly into the workforce through our Proof-of-Skills Hiring model,” Olufunmilayo explained.
Speaking at the launch, Francis Sani, Technical Adviser for Innovation, Entrepreneurship, and Capital to the Minister of Communications, Innovation, and Digital Economy, highlighted Nigeria’s demographic advantage.
He noted that Nigeria has the largest youth population in Africa, with a median age of 16 years, compared to 38 in the U.S. and 46 in Japan. This, he said, positions the country as a key player in the global tech competitiveness race.
However, Sani emphasized that access to quality training and employment pathways remains a significant challenge. “We have the talent, we have the ambition, but we must scale up digital skills to compete globally,” he stated.
Senate Votes to Compel Facebook, Others to Open Offices in Nigeria
Google to Buy Cybersecurity Company Wiz for $32Bn
MTN Group to Invest $10Bn in African Expansion by 2030
ATCON Calls for Telecom Policy Improvements in Nigeria
9mobile Reinforces Innovation Leadership with Echoes, Its Trailblazing AI Storytelling Platform
General News2 days agoJumia Nigeria Kicks Off Tech Week 2025
Telecom2 days agoBridging Nigeria’s Digital Divide: ITU and UK-FCDO Fuel Rural Connectivity Revolution
E-Financial2 days agoSEC Voids Mainland Trust’s Registration, Suspends Centurion Registrars
E-Business2 days agoNITDA Expands iHATCH Initiative to Drive Job Creation, Economic Diversification
Telecom2 days agoTransforming Lives Through Advocacy: Princess Omoyemwen Inspires Change at MTN’s Go MAD Activation in Benin
E-Financial1 day agoCentral Bank Defends Naira with $360m in 5-Day
Telecom1 day agoMTN’s Earnings Hammered by Free Falling Naira in Nigeria
E-Business1 day agoFG Partners Cyberpedia to Fight Misinformation with AI