How sophisticated scammers and phishers are preying on customers of Silicon Valley Bank

This post details a specific SVB-themed KYC phishing campaign leveraging DocuSign branding, observed on March 14, 2023. It outlines the multi-stage redirect chain used by the attackers, starting from a malicious link to a Google Firebase application, then to a WordPress site, and finally to an attacker-controlled domain (docusigning[.]kirklandellis[.]net). It provides Indicators of Compromise (IOCs) such as malicious domains and IP addresses, and offers recommendations for Cloudflare Email Security and Gateway customers, including DMARC policy enforcement and phishing awareness training. The post highlights Cloudforce One's proactive monitoring and detection capabilities for such topical threats.