Brand impersonation: Zoho Sign document request

calendar Nov 9, 2026  ·
Share on: linkedin copy

Detects messages that impersonate Zoho Sign document-signing notifications by including a legitimate-looking guest signing link and forged thread references to a prior Zoho Sign notification, yet lack any authentic Zoho DKIM signature on the message. The lure typically poses as a colleague or business contact requesting review and signature of a document or proposal, aiming to lead recipients to a fraudulent signing page. Highly trusted sender domains that pass DMARC are excluded to reduce false positives.

Sublime rule (View on GitHub)

 1name: "Brand impersonation: Zoho Sign document request"
 2description: "Detects messages that impersonate Zoho Sign document-signing notifications by including a legitimate-looking guest signing link and forged thread references to a prior Zoho Sign notification, yet lack any authentic Zoho DKIM signature on the message. The lure typically poses as a colleague or business contact requesting review and signature of a document or proposal, aiming to lead recipients to a fraudulent signing page. Highly trusted sender domains that pass DMARC are excluded to reduce false positives."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // zoho sign's notification footer is in the current message, not a quoted thread
 8  and strings.icontains(body.current_thread.text,
 9                        "automated email from Zoho Sign"
10  )
11  // with somewhere to send the recipient... zoho's own report-abuse footer link doesn't count
12  and any(body.current_thread.links,
13          .href_url.scheme in ("http", "https")
14          and not (
15            .href_url.domain.root_domain == "zoho.com"
16            and strings.istarts_with(.href_url.path, "/report-abuse")
17          )
18  )
19  // but it never left zoho sign's sending infra... regional DCs use ccTLD variants (.ca, .net.au, .net.uk, .uk)
20  and not any(headers.hops,
21              regex.imatch(.received.source.raw,
22                           '[^ (]+\.(?:transmail\.net(?:\.in)?|zeptomail\.(?:net(?:\.[a-z]{2})?|[a-z]{2})|zohomail360\.[a-z]{2}) .*'
23              )
24  )  
25attack_types:
26  - "Credential Phishing"
27  - "BEC/Fraud"
28tactics_and_techniques:
29  - "Impersonation: Brand"
30  - "Social engineering"
31  - "Spoofing"
32detection_methods:
33  - "Header analysis"
34  - "URL analysis"
35  - "Sender analysis"
36  - "Content analysis"
37id: "1ff2234e-b418-5c99-8318-532ffe069ea3"
to-top