Kaspersky has uncovered an ongoing phishing campaign that impersonates Zoom and Docusign official emails, demonstrating that attackers continue to use basic phishing tactics, according to TahawulTech.
The campaign, active since the early weeks of the post-holiday season, targets corporate accounts across the Middle East, Latin America, Western Europe, Russia, Armenia, and Azerbaijan. Initially, attackers sent emails impersonating Docusign, containing phishing links designed to steal credentials. A subsequent wave impersonated Zoom, warning users of account disablement. These emails employed two lures: credential-stealing phishing links and embedded forms requesting personal information and credit card details. As of September 2026, over one thousand phishing emails have been detected.
Andrey Kovtun from Kaspersky noted that while sophisticated attacks are common, simple, low-tech tactics can still be effective due to the sheer volume of emails employees receive. He emphasized the need for dedicated security solutions to catch these threats, rather than relying solely on human vigilance. Kaspersky recommends deploying email security solutions, conducting employee training, integrating extended defense systems, regularly informing employees about threats, conducting controlled phishing tests, and implementing multi-factor authentication.
Source: TahawulTech
