Access-Code-Gated Phishing Chain Delivers Vidar Infostealer via DocuSign Impersonation

Key facts for Vidar DocuSign phishing campaign

Detection coverage for Vidar DocuSign phishing campaign

As of 2026-09-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2456 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: DocuSign-Impersonating Phishing Installer Execution (SPL)

Detects execution of the first-stage installer DocuSign_PackageInstaller.exe (a code-signed .NET single-file bundle abusing a China-issued PE code-signing certificate) by filename or known file hash, correlated with proxy traffic to the DocuSign-impersonating lure domain docu.sign-platform.app. This is the exploitation/initial-access moment of the access-code-gated Vidar delivery chain: a spearphishing link leads a user to run a masquerading, illegitimately signed installer.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566, T1204, T1036, T1553, T1583, T1588
• Data sources: sysmon, web_proxy
• Severity: high
• Confidence: high

Splunk SPL

(index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
 (Image="*\\DocuSign_PackageInstaller.exe" OR OriginalFileName="DocuSign_PackageInstaller.exe" OR SHA256="3a7f8b2c1d11f024c24c14ced04c0d4ba64b40eda0f890b393e4a06263fd019a" OR MD5="2e012cb0698680cfcb0e569fb22358f6"))
| eval detection_source="process"
| table _time, ComputerName, User, Image, ParentImage, CommandLine, SHA256, MD5, detection_source
| append
    [ search index=proxy sourcetype=proxy earliest=-24h
      | where match(url, "(?i)docu\.sign-platform\.app")
      | eval detection_source="proxy"
      | table _time, src_ip, dest_ip, url, detection_source ]
| sort - _time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "DocuSign_PackageInstaller.exe"
    or SHA256 == "3a7f8b2c1d11f024c24c14ced04c0d4ba64b40eda0f890b393e4a06263fd019a"
    or MD5 == "2e012cb0698680cfcb0e569fb22358f6"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA256, MD5
| union (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has "docu.sign-platform.app"
    | project Timestamp, DeviceName, AccountName = "", FileName = "docu.sign-platform.app", FolderPath = RemoteUrl, ProcessCommandLine = "", InitiatingProcessFileName, SHA256 = "", MD5 = ""
)
| sort by Timestamp asc

Sigma

title: DocuSign-Impersonating Phishing Installer Execution (Vidar Delivery Chain)
id: 7c1e4b2a-9f3d-4e6a-8b1c-2d5f6a7b8c01
status: experimental
description: Detects execution of the DocuSign_PackageInstaller.exe first-stage installer used in an access-code-gated malware delivery chain leading to the Vidar infostealer, or process activity matching its known file hashes.
references:
  - https://www.joesecurity.org/blog/8930920806197220285
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-12
tags:
  - attack.resource-development
  - attack.t1583.001
  - attack.t1588.003
  - attack.initial-access
  - attack.t1566.002
  - attack.execution
  - attack.t1204.002
  - attack.defense-evasion
  - attack.t1553.002
  - attack.t1036.005
  - attack.tool.vidar
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|endswith: '\DocuSign_PackageInstaller.exe'
  selection_hash:
    Hashes|contains:
      - '3A7F8B2C1D11F024C24C14CED04C0D4BA64B40EDA0F890B393E4A06263FD019A'
      - '2E012CB0698680CFCB0E569FB22358F6'
  condition: 1 of selection_*
falsepositives:
  - Legitimate DocuSign installers are digitally distributed via docusign.com and will not match this filename/hash combination; verify certificate issuer/thumbprint before dismissing a hit
level: high

Known false positives:

• Legitimate DocuSign desktop installers do not use this filename or these hashes and are digitally signed by DocuSign, Inc. — verify certificate issuer/thumbprint before treating a filename-only match as malicious.
• docu.sign-platform.app is not a domain DocuSign owns; any hit is inherently suspicious, but confirm via WHOIS/passive DNS before extending the rule to other DocuSign-lookalike subdomains not yet confirmed malicious.

Tuning notes: Maintain the SHA256/MD5 hash list as a lookup table (not inline literals) so new first-stage installer builds can be added without editing the query; add the certificate serial/thumbprint as an additional selector once captured from EDR code-signing telemetry.

• 🔒 DocuSign-Impersonating Phishing Installer Execution (KQL) · unlock with TL Creds
• 🔒 Access-Code C2 Gate, Online Time-Bomb Check & Second-Stage Execution (KQL) · unlock with TL Creds
• 🔒 Vidar Dead-Drop C2 Beaconing, Dropzone Staging & Browser-Credential Access (KQL) · unlock with TL Creds
• 🔒 DocuSign-Impersonating Phishing Installer Execution (Sigma) · unlock with TL Creds
• 🔒 Access-Code C2 Gate, Online Time-Bomb Check & Second-Stage Execution (Sigma) · unlock with TL Creds
• 🔒 Vidar Dead-Drop C2 Beaconing, Dropzone Staging & Browser-Credential Access (Sigma) · unlock with TL Creds
• 🔒 Access-Code C2 Gate, Online Time-Bomb Check & Second-Stage Execution (SPL) · unlock with TL Creds
• 🔒 Vidar Dead-Drop C2 Beaconing, Dropzone Staging & Browser-Credential Access (SPL) · unlock with TL Creds

Indicators of compromise for Vidar DocuSign phishing campaign

As of 2026-09-12, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-2456.

Sample indicators (3 of 17)

• IP address: 185.153.198[.]115
• Domain: docu[.]sign-platform[.]app
• File hash: 3a7f8b2c1d11f024c24c14ced04c0d4ba64b40eda0f890b393e4a06263fd019a

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

Community OSINT corroboration for Vidar DocuSign phishing campaign

2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Vidar DocuSign phishing campaign works

Joe Security documented a multi-stage malware delivery chain that impersonates DocuSign to distribute the Vidar infostealer. The attack begins with a phishing email pointing victims to a lookalike page at docu.sign-platform.app, which serves DocuSign_PackageInstaller.exe — a single-file .NET bundle carrying a valid PE code-signing certificate issued to a China-based organization. The installer contains signature- and access-code-verification logic: it transmits an operator-entered access code to a registration endpoint at 185.153.198.115/api/submit, and only downloads the second-stage payload once the C2 server validates that code. This access-code gate is specifically designed to block both automated sandboxes and manual analysts who lack a valid code.

Joe Reverser bypassed this gate through static analysis alone, recovering the second-stage native binary without ever satisfying the runtime access-code check. That binary contains an early time-bomb check that is deliberately built to query an online time source rather than the local system clock, defeating the common sandbox-analysis technique of rolling back or manipulating the local clock to skip time-gated logic. After the time check passes, classic packing is used as an additional obfuscation layer before the payload unpacks into the Vidar infostealer, a commodity credential- and browser-data-stealing malware family that exfiltrates harvested data to its operators. A set of dropzone paths on training-vibe.forum (covering PE, DLL, Python, PowerShell, and batch-script archives) was documented as staging infrastructure for stealer components.

No CVE or CVSS applies — this is a social-engineering and malware-delivery chain, not a software vulnerability. Its significance is the layered evasion design: a paid-for/abused valid code-signing certificate, a C2-gated access-code check that blocks offline/sandbox analysis, and an online (not local) time-based anti-sandbox trigger that resists clock manipulation.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1480 Execution Guardrails; T1497 Virtualization/Sandbox Evasion

Command and Control

T1071 Application Layer Protocol

Execution

T1204 User Execution

defense-impairment

T1553 Subvert Trust Controls

Credential Access

T1555 Credentials from Password Stores

Initial Access

T1566 Phishing

Resource Development

T1583 Acquire Infrastructure; T1588 Obtain Capabilities

Remediation for Vidar DocuSign phishing campaign

Immediate actions

• Block network indicators docu.sign-platform.app, 185.153.198.115, and training-vibe.forum at DNS/proxy/firewall
• Hunt EDR and proxy logs for execution of DocuSign_PackageInstaller.exe or index.exe and for outbound requests to /api/submit?code=
• Alert on and quarantine the documented first- and second-stage file hashes across the fleet

Workarounds

• Restrict execution of unsigned or newly observed installer packages delivered via email links through application allowlisting
• Block or inspect outbound HTTP to raw IP-literal endpoints from end-user workstations where feasible

Longer-term hardening

• Deploy behavioral EDR detection for execution-guardrail patterns: installers that wait on a server-validated secret before fetching a second payload
• Do not treat a valid code-signing signature alone as a trust signal; enforce certificate-issuer reputation/allowlisting given confirmed abuse of a validly issued certificate
• Run user-awareness training on DocuSign-branded phishing and lookalike e-signature domains, since the lure requires no vulnerability, only user trust

Timeline of Vidar DocuSign phishing campaign

• 2026-08-01 Joe Security publishes the technical writeup 'Breaking Down an Access-Code-Gated Malware Delivery Chain' documenting the full chain and IOCs.
• 2026-08-01 Dropzone infrastructure at locked-ioc-14, with PE/DLL/Python/PowerShell/batch archive paths, is documented as staging for stealer components.
• 2026-08-01 The unpacked payload is confirmed to be the locked-ioc-17 infostealer.
• 2026-08-01 Classic packing is documented as an additional obfuscation layer applied to the second-stage payload.
• 2026-08-01 An early time-bomb check in the second-stage binary is found to query an online time source rather than the local system clock, defeating local clock manipulation.
• 2026-08-01 Joe Reverser extracts the second-stage native binary (locked-ioc-16) via static analysis alone, bypassing the runtime access-code requirement.
• 2026-08-01 Access-code submission is traced to a registration endpoint at locked-ioc-15/api/submit?code={CODE}; the second stage is released only after server-side validation.
• 2026-08-01 Analysis of locked-ioc-12 reveals a code-signed .NET single-file bundle carrying signature- and access-code-verification logic gating the second stage.
• 2026-08-01 Joe Security identifies a DocuSign-themed phishing page at locked-ioc-13 serving a fraudulent installer, locked-ioc-12.

Sources cited for Vidar DocuSign phishing campaign

• What Is an Infostealer? How Credential-Stealing Malware Works SentinelOne · Vendor report
• Vidar Stealer: Malware Evolution & Acronis Defenses acronis.com · Vendor report
• Fast, Broad, and Elusive: How Vidar Stealer 2.0 Upgrades Infostealer Capabilities Trend Micro · Research
• Deep Malware and Phishing Analysis - Breaking Down an Access-Code-Gated Malware Delivery Chain joesecurity.org · Blog · 2026-08-01
• Anomali Cyber Watch: ROBOT Malware, GlassWorm, Vidar Stealer 2.0 anomali.com · Blog

More in malware

• CyberStrikeAI: AI-orchestrated pentest/C2 framework used in real-world attacks on educational institutions in Africa and Latin America
• Cryptomining Campaign Targeting Linux SSH Servers (XMRig, ShellBot, XHide, Go-based downloaders)
• SloppyRAT: New ClickFix-Delivered Remote Access Trojan Supporting Ransomware Operations
• QuimaRAT: Java-based cross-platform Remote Access Trojan offered as Malware-as-a-Service
• APT37 NarwhalRAT: MS-Themed Phishing and pCloud Dead-drop C2 Targeting Korean Users