We received a DocuSign-branded "document ready" message that survived every mailbox authentication check that defenders are taught to trust. SPF passed. DKIM passed. DMARC passed. Proton still stamped it phishing. That combination is the point of this campaign: the pipe is legitimate SaaS mail; the payload is a remote-access installer.
We did not install the MSI on a production host. We saved it, hashed it, extracted the WiX package, and read the ScreenConnect launch parameters out of system.config and the MSI property table. The chain ends in a named Guest Access session on a live ConnectWise cloud relay — not a custom RAT, not a packed stealer. Hands-on-keyboard access sold as paperwork.
Full chain graph: Wufoo/SparkPost delivery → sas[.]com[.]ru → abre[.]ai → document-approvals031902[.]es → Dropboxusercontent MSI → Guest Access → instance-hxm042-relay.screenconnect[.]com → 15[.]204[.]0[.]87 (AS16276 OVH).
Delivery That Passes DMARC
The message arrived Sat, 12 Sep 2026 02:05:06 +0000 with subject DocuSign:New Document is ready. Display name DocsAdmin, envelope and header From on wufoo[.]com / bounces.wufoo[.]com. Return-Path was bounces@bounces.wufoo[.]com. Proton authentication results:
| Check | Result |
|---|---|
| SPF | pass (bounces.wufoo[.]com) |
| DKIM | pass (wufoo[.]com, selector scph0817) |
| DMARC | pass (header.from=wufoo[.]com) |
| Path | SparkPost MTA 192[.]174[.]81[.]40 → Proton |
| Proton action | X-Pm-Spam-Action: phishing |
This is authenticated Wufoo/SurveyMonkey outbound, not a spoofed docusign[.]com From. Someone abused a form-notification pipe that already has domain reputation and SparkPost delivery. The CTA button read VIEW SIGNED DOCUMENT and pointed at a third-party shortener, not DocuSign.
Link Laundry
Following the CTA produced a short, deliberate redirect chain before any fake brand page appeared:
hxxps://www.sas[.]com[.]ru/l/kGxh
→ hxxps://abre[.]ai/sRhm
→ hxxps://document-approvals031902[.]es/new_documents/Two hops of laundry, then a Cloudflare-fronted .es host dressed as a document portal. Filters and humans see different reputation at each step. The destination is the only place that needs to look like DocuSign.
The Landing Page Lies About the Filename
The landing page clones DocuSign visual language: logo treatment, "Windows Document" badge, "Your document has been downloaded," numbered NEXT ACTION steps. Step 2 tells the victim to find a file named `Payment_Summary_ST`. A large blue button offers "Download again."
What the browser actually saves is not a payment summary. The Save As dialog shows ScreenConnect.ClientSetup as a Windows Installer Package, sourced from Dropbox's dl.dropboxusercontent[.]com CDN (uc6b539d635087b89cec511e4b23…). The page gaslights; the disk tells the truth.
Inside the MSI: Guest Access, Not a Custom Implant
We treated the installer as the product. SHA-256 fe1b07a5e06be98e8f0db0139383a3484624275da90f6e74ed9de5c48a776364, size 16,936,960 bytes, WiX 3.11 package dated 2026-09-08 17:06:34 UTC, client version 26.6.6.97470. Product name: ScreenConnect Client (c2cfc1c8d2ce8e50). URL protocol: sc-c2cfc1c8d2ce8e50.
Launch parameters recovered from SERVICE_CLIENT_LAUNCH_PARAMETERS / system.config:
| Param | Value | Meaning |
|---|---|---|
e | Access | Access mode |
y | Guest | Join as Guest |
h | instance-hxm042-relay.screenconnect[.]com | Cloud relay hostname |
p | 443 | TLS |
k | RSA pubkey blob (~368 chars base64) | Instance key constraint |
c | buumutdiv screen | Baked session / custom name |
DNS on the relay: instance-hxm042-relay.screenconnect[.]com CNAME server-ovh30010003-relay.screenconnect[.]com → `15[.]204[.]0[.]87`, AS16276 OVH SAS, Hillsboro, OR. The client is pre-configured Guest Access for cloud instance `hxm042` / `c2cfc1c8d2ce8e50`, session label `buumutdiv screen`. Install it and an operator on that instance gets a remote session through legitimate RMM infrastructure that many AV stacks treat as business software.
Their Play
This is cheap initial access dressed as paperwork. The operators are not stealing a DocuSign password. They are buying a human on the other end of ScreenConnect.
The stack is almost entirely trusted brands: Wufoo for authenticated delivery, DocuSign for the costume, Dropbox for payload CDN, ConnectWise ScreenConnect for the foothold. There is no custom implant to burn on first contact. One cloud instance can catch many "document" victims. After Guest Access lands: mail and browser loot, BEC, crypto theft, access resale — whatever pays. The durable selectors are the instance id, the session string buumutdiv screen, the relay hostname, and the MSI hash — not a novel C2 protocol.
Assessment
We assess with high confidence that this message is a live RMM initial-access campaign using abused SaaS mail and a DocuSign social-engineering front. Confidence rests on: (1) byte-level MSI ownership and ScreenConnect launch params recovered from the package; (2) observed redirect chain from the CTA through two shorteners to the .es landing; (3) screenshot-confirmed Dropboxusercontent delivery of ScreenConnect.ClientSetup.msi while the page claims Payment_Summary_ST; (4) authenticated Wufoo/SparkPost headers with Proton phishing action.
We did not join the Guest session from a lab host for this write-up. The MSI already names the room. Defenders should treat Guest Access installers arriving from document lures as confirmed compromise attempts even when the file is a "legitimate" ScreenConnect client.
Indicators of Compromise
Email / Delivery
| Type | Indicator | Context |
|---|---|---|
| From | DocsAdmin <no-reply@wufoo[.]com> | Authenticated Wufoo sender |
| Return-Path | bounces@bounces.wufoo[.]com | SurveyMonkey/Wufoo bounce domain |
| Subject | DocuSign:New Document is ready | Lure |
| Message-ID | <68.0B.03506.253B4AA6@…sparkpost> | SparkPost path |
| IP | 192[.]174[.]81[.]40 | SparkPost MTA observed |
| EML SHA-256 | 131094b1ee80104219c8893b4450cb60c81c7916d6ab87bc11c288114e63ed1b | Captured message |
Redirect / Landing
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps://www.sas[.]com[.]ru/l/kGxh | CTA first hop |
| URL | hxxps://abre[.]ai/sRhm | Second shortener |
| URL | hxxps://document-approvals031902[.]es/new_documents/ | Fake DocuSign portal |
| Domain | document-approvals031902[.]es | Landing host (Cloudflare) |
| Host | uc6b539d635087b89cec511e4b23.dl.dropboxusercontent[.]com | MSI CDN |
Payload / ScreenConnect
| Type | Indicator | Context |
|---|---|---|
| Filename | ScreenConnect.ClientSetup.msi | Delivered installer |
| SHA-256 | fe1b07a5e06be98e8f0db0139383a3484624275da90f6e74ed9de5c48a776364 | MSI |
| Product | ScreenConnect Client (c2cfc1c8d2ce8e50) | Instance-bound client |
| Instance ID | c2cfc1c8d2ce8e50 | ScreenConnect client id |
| Session | buumutdiv screen | Launch param c |
| Host | instance-hxm042-relay.screenconnect[.]com | Relay (h) |
| CNAME | server-ovh30010003-relay.screenconnect[.]com | Relay backend name |
| IP | 15[.]204[.]0[.]87 | Relay A record |
| ASN | AS16276 OVH SAS | Hillsboro, OR |
| Protocol | sc-c2cfc1c8d2ce8e50 | Custom URL scheme |
| Version | 26.6.6.97470 | Client version |
Host / Behavior Signals
| Signal | Context |
|---|---|
DocuSign-themed page instructing open of Payment_Summary_ST while MSI downloads | Filename gaslighting |
New ScreenConnect Guest client pointing at hxm042 / c2cfc1c8d2ce8e50 | Post-install beacon |
Outbound TLS to instance-*-relay.screenconnect[.]com:443 after a document lure | RMM foothold |