Corporate phishing campaign impersonates Zoom and DocuSign platforms

Kaspersky has detected an ongoing phishing campaign targeting corporate accounts by impersonating official emails from Zoom and DocuSign. The first wave, impersonating DocuSign communications, targeted corporate accounts in the Middle East, Latin America, Western Europe, Russia, Armenia and Azerbaijan with credential-stealing links, while the second, still-active wave impersonated Zoom notifications warning of imminent account deactivation, using redirect pages and embedded forms that harvest personal data and credit card details. More than 1,000 phishing emails have been detected as of September 2026, and the company recommended specialized security solutions, continuous employee training and enabling multi-factor authentication.