DocuSign Approval Email Scam Uses a Fake Contract to Steal Your Password
Written by: Lapain Epuran
Published on:
A revised contract is exactly the sort of document people expect to move quickly. The DocuSign Approval Email Scam uses that familiar workflow, adds a 24-hour deletion threat, and sends the recipient to a password-stealing imitation. The pressure feels procedural rather than theatrical, which makes the trap unusually effective.
The subject reads “Complete with Docusign: Revised Contract – Signature Required.” Inside, the message claims Binghatti shared a revised contract and presents a large “REVIEW PENDING DOCUMENT” button.
A warning says the pending document will be deleted after 24 hours. That deadline is meant to make recipients review first and verify later, especially when contracts, property, procurement, or employment decisions may be time-sensitive.
The analyzed button led to mail87[.]lookaware[.]top, not an official Docusign domain. The landing page closely imitated an electronic-signature login and requested an email address and password before showing any real contract.
Overview
A Familiar Contract Workflow Creates Trust
The subject resembles a normal electronic-signature request and describes a Revised Contract rather than a random file. That wording implies a business history the recipient may assume a colleague already knows.
Naming Binghatti gives the request a recognizable counterparty, while the lack of project details keeps the lure flexible. The recipient sees just enough context to wonder whether the agreement belongs to another department.
The claimed 24-hour deletion window discourages that department check. A contract can affect money, property, employment, or deadlines, so waiting to ask a question may feel riskier than opening it immediately.
The 24-Hour Deadline Blocks Verification
REVIEW PENDING DOCUMENT leads to mail87[.]lookaware[.]top, not to docusign.com or docusign.net. The copied signing interface begins only after the browser has already left the legitimate service.
The page asks for an email address and password before showing verifiable agreement details. A contract title carried in the phishing link can personalize the screen without any connection to a genuine Docusign envelope.
The Fake Login Can Expose Real Agreements
A stolen login may expose real agreements, parties, addresses, and signature history. If the password was reused for webmail, the intruder may also gain the conversations that explain what those documents mean.
That combined access supports convincing contract amendments, payment changes, and new signature requests. The fake revised contract is therefore a doorway into both document fraud and broader business impersonation.
Contract platforms also contain relationships that are difficult to reconstruct after an incident. A criminal who sees who signs, who reviews, and which projects are active can tailor later messages to the exact people most likely to approve a sensitive request. The attacker learns the approval chain before targeting it carefully.
Subject used: Complete with Docusign: Revised Contract – Signature Required.
Claimed sender: Binghatti.
Document: Revised Contract.
Button: REVIEW PENDING DOCUMENT.
Pressure: the pending document will supposedly be deleted after 24 hours.
Observed destination: mail87[.]lookaware[.]top, not an official Docusign domain.
How to Separate a Real Docusign Request From This Lure
The Domain Must Belong to the Expected Service
Docusign advises users to examine the sender and destination and to treat messages from unofficial domains cautiously. Official notification routes use Docusign-controlled domains, not arbitrary lookalike addresses. This check remains useful even when the message is beautifully formatted.
A copied logo or matching button color cannot repair the lookaware[.]top mismatch. The address bar is independent evidence that the recipient has left the genuine signing service. Review it before typing an email address, not after a password has been submitted.
Unexpected Documents Need Sender Verification
Even a technically genuine electronic-signature notification can contain an unwanted or abusive document. The recipient should know who sent the agreement and why approval is expected before opening it. Colleagues should also know which person owns the approval decision.
Contact Binghatti or the named business through an existing contract, saved contact, or official website. Do not use a telephone number or reply address supplied only by the questionable email. A short independent call can prevent a much longer account-recovery process.
A Security Code Offers a Safer Route
Docusign says recipients can open its official site directly and use the unique security code found in a legitimate notification to access a document. This avoids relying on the embedded review link and keeps the browser on a known domain.
Docusign also accepts suspicious impersonation emails at verify@docusign.com. Forwarding the message as an attachment preserves details that a screenshot or ordinary forward can lose, including routing information useful during verification.
How the DocuSign Approval Email Scam Works
Step 1: A Contract-Themed Notification Arrives
The campaign copies the rhythm of an electronic-signature email and uses a subject beginning Complete with Docusign. That familiar construction can pass a quick visual check.
The named sender, Binghatti, may be relevant to some recipients and meaningless to others. Broad campaigns count on curiosity, while targeted versions can select companies that fit the victim’s industry.
Step 2: A Revised Contract Suggests Existing Business
Calling the file Revised Contract implies there was an earlier negotiation, even when none occurred. Recipients may assume a colleague handled the first version or that the request belongs to another department.
The wording avoids specific clauses, parties, or project identifiers that could be disproved. The promised document remains hidden until after the recipient follows the attacker’s route.
Step 3: A 24-Hour Deletion Threat Forces the Pace
The DocuSign Approval Email Scam says the pending file will disappear after 24 hours. A reader may fear delaying a deal or asking an embarrassing question about a contract they should recognize.
Docusign safety guidance warns that urgency and unexpected documents are phishing indicators. A legitimate business partner can resend or confirm an agreement through a known channel.
Step 4: The Review Button Opens lookaware.top
Selecting REVIEW PENDING DOCUMENT moves the browser to mail87[.]lookaware[.]top. The presence of words such as mail or document would not make this an official signing host.
On mobile, the full domain can be easy to overlook. Expanding the address bar before entering anything reveals that the contract page is outside Docusign’s controlled domains.
Step 5: A Copied Sign-In Screen Requests Credentials
The landing page resembles a Docusign authentication form and asks for an email address and password. It may include a contract title so the transition from email feels continuous.
No real agreement is required for the page to display those details because they were already embedded in the phishing link. Submitting the form sends the credential to the scammer.
Step 6: The Page Hides Theft Behind an Error or Redirect
The imitation may claim the password is wrong, show a loading screen, or redirect to the real Docusign homepage. Each ending makes the interaction look like a temporary document problem.
A second password entry can help the operator correct a typo. A redirect to the real brand does not undo the transmission that occurred on the unrelated host.
Step 7: Stolen Access Fuels Document and Email Fraud
The attacker may test the credential against Docusign and the victim’s email provider. Reuse is especially dangerous because access to both services provides documents and the communication context around them.
Criminals can send fraudulent agreements, replace payment instructions, collect signatures on deceptive files, or use exposed identity details in later impersonation. The impact can extend well beyond one missing contract.
Company, Address, and Fulfillment Checks
Company: Confirm Binghatti Independently
Ask whether the recipient has a current relationship, named contact, and expected revised contract with Binghatti. Use contact details from existing records or the company’s official site.
If nobody can identify the request, do not treat the brand name as proof. A real organization can be impersonated without its systems being involved.
Address: Use Docusign’s Official Domains
Inspect both the sender address and link destination. Docusign identifies docusign.com and docusign.net as official domains and warns about lookalike links.
The observed lookaware[.]top host fails that check. Report it rather than attempting additional passwords or trying alternate buttons on the same page.
Support: Verify or Report the Email
Forward a suspicious Docusign impersonation email as an attachment to verify@docusign.com. Business users should also notify their internal security team so other recipients can be protected.
For a legitimate notification, open docusign.com directly and use the Access Documents feature with the security code from the email. This creates a safer path than the embedded link.
Fulfillment: Match the Agreement and Parties
A real revised contract should match an earlier draft, project, counterparty, and approval process. Ask the contract owner to confirm the version and expected signer.
The phishing page cannot provide that evidence before authentication. Its password form is not contract fulfillment; it is the point where the attacker collects access.
Warning Signs in a Fake DocuSign Approval Email
Electronic-signature phishing can be visually accurate. The strongest checks are whether the agreement is expected and whether the domain remains within Docusign’s real service.
The recipient was not expecting a revised contract from Binghatti.
The email threatens deletion after 24 hours to discourage verification.
REVIEW PENDING DOCUMENT leads to lookaware[.]top or another unofficial domain.
The landing page asks for credentials before showing verifiable agreement details.
The sender address differs subtly from docusign.com or docusign.net.
No project owner, counterparty, or earlier contract version can confirm the request.
The message lacks a usable security code for access through the official Docusign site.
Do not approve a contract merely because the interface looks familiar. A real agreement has people, history, and a known business purpose that can be confirmed without the email’s button.
What to Do if You Have Fallen Victim to This Scam
If the imitation sign-in page received your password, act before the attacker can open real envelopes or test the same credential elsewhere. Use official sites and known support channels only.
Change the affected Docusign or email password. Open the official service manually and choose a unique replacement. Explain that the DocuSign Approval Email Scam captured the previous credential.
Revoke sessions and connected applications. Sign out other devices, remove unfamiliar integrations, and check whether the account created or sent any envelopes you do not recognize.
Enable strong multifactor authentication. Prefer a passkey or security key when supported. Reject unexpected prompts and remove recovery methods or authenticators added by someone else.
Review exposed agreements and recipients. Identify documents opened, downloaded, changed, or sent after the click. Notify contract owners and counterparties through verified channels if confidentiality or signature integrity may be affected.
Secure the connected mailbox. Change its password if reused, revoke mail sessions, and inspect forwarding rules, delegates, and OAuth applications. Email access can let the criminal reset the Docusign account again.
Warn finance, legal, and procurement teams. Require independent confirmation for contract amendments, bank-detail changes, and urgent approvals. Provide the campaign subject and defanged destination.
Run Malwarebytes if anything downloaded or installed. The observed page targeted credentials, but a variant may add a file or extension. Update Malwarebytes, perform a full scan, and retain the results.
Use AdGuard as an additional web defense. AdGuard may block known phishing hosts, ads, and redirectors. It cannot revoke submitted credentials or guarantee detection of a new lookalike domain.
Report the impersonation to Docusign. Forward the complete email as an attachment to verify@docusign.com or use Docusign’s Report Abuse process. Notify internal security as well.
Preserve a complete incident record. Keep headers, URLs, screenshots, access logs, affected envelope IDs, and support case numbers. Report financial loss or identity misuse to the appropriate authorities and insurer.
Is Your Device Infected? Run a Free Malware Scan
Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. The fastest way to find out is to scan your device with Malwarebytes Anti-Malware Free — one of the most trusted malware removal tools available.
The free version detects and removes the most common threats, including:
Adware — the cause of those annoying pop-ups
Browser hijackers — unwanted redirects and changed homepages
Trojans and spyware — hidden programs stealing your data
Potentially unwanted programs (PUPs) — software you never asked for
👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The whole process takes about 5 minutes.
Malwarebytes for WindowsMalwarebytes for MacMalwarebytes for Android
Run a Malware Scan with Malwarebytes for Windows
Malwarebytes is one of the most popular and trusted anti-malware tools for Windows — and it’s completely free for removing infections. It catches threats that many antivirus programs miss, including adware, browser hijackers, and trojans. Follow the steps below to scan and clean your PC in just a few minutes.
Download Malwarebytes
Click the button below to download the latest version of Malwarebytes for Windows from the official source. The free version is all you need — it will scan your computer and remove adware, browser hijackers, and other malicious software at no cost.
(The link opens in a new page where your download will start)
Install Malwarebytes
When the download finishes, open your Downloads folder and double-click the MBSetup file. If Windows shows a User Account Control pop-up, click “Yes” to allow the installation.
Follow the On-Screen Prompts to Install Malwarebytes
The setup wizard will walk you through a few quick screens:
Choose where you’re installing the program — “Personal Computer” or “Work Computer” — then click Next.
Malwarebytes will now install on your device. This usually takes under a minute.
When installation is complete, the “Welcome to Malwarebytes” screen will open automatically.
On the final screen, click Open Malwarebytes to launch the program.
Enable “Scan for Rootkits”
Before scanning, turn on rootkit detection so Malwarebytes can find even the most hidden threats. Click the Settings gear icon on the left side of the screen.
In the settings menu, find “Scan for rootkits” and click the toggle so it turns blue.
Done? Click “Dashboard” in the left pane to return to the main screen.
Start the Scan
Click the blue Scan button. Malwarebytes will automatically update its virus database and start checking your computer for malware.
Wait for the Scan to Finish
The scan checks your entire system for browser hijackers and other malicious programs, so it can take several minutes. Feel free to do something else — just check back occasionally to see the progress.
Quarantine the Detected Threats
When the scan is done, you’ll see a list of everything Malwarebytes found — malware, adware, and potentially unwanted programs. Click the “Quarantine” button to remove all of them at once.
Malwarebytes will now remove the malicious files and registry entries and move them safely into quarantine.
Restart Your Computer
Some threats can only be fully removed after a reboot. If Malwarebytes asks you to restart, click Yes. Once you’re logged back in, your PC is clean and you can continue with the next steps in this guide.
When the scan finishes, click Quarantine to remove everything Malwarebytes found. That’s it — your Windows PC is now clean of trojans, adware, and other malware, and should be back to running smoothly.
If your current antivirus allowed this malicious program on your computer, you may want to consider purchasing Malwarebytes Premium to protect against these types of threats in the future. If you are still having problems with your computer after completing these instructions, then please follow one of the steps:
Malwarebytes for Mac is a free on-demand scanner that removes the malware other security software tends to miss — adware, browser hijackers, and unwanted programs included. Cleaning an infected Mac with Malwarebytes has always been completely free, and it’s our go-to recommendation. Follow the steps below to scan and clean your Mac in just a few minutes.
Download Malwarebytes for Mac
Click the button below to download the latest version of Malwarebytes for Mac.
When the download finishes, open your Downloads folder and double-click the setup file to begin the installation.
Follow the On-Screen Prompts to Install Malwarebytes
The Malwarebytes for Mac Installer will guide you through a few quick screens. Click “Continue” and keep following the prompts until the installation completes.
When the installation is complete, Malwarebytes opens to the Welcome to Malwarebytes screen. Click “Get started“.
Select “Personal Computer” or “Work Computer”
Malwarebytes will ask what type of computer you’re installing it on. Click either Personal Computer or Work Computer, whichever applies.
Start the Scan
Click the “Scan” button. Malwarebytes will automatically update its detection database and begin checking your Mac for malware.
Wait for the Scan to Finish
Malwarebytes will scan your Mac for adware, browser hijackers, and other malicious programs. This can take a few minutes, so feel free to do something else — just check back occasionally to see the progress.
Quarantine the Detected Threats
When the scan is done, you’ll see a list of everything Malwarebytes found. Click the “Quarantine” button to remove all the threats at once.
Restart Your Mac
Malwarebytes will now remove all the malicious files it found. Some threats can only be fully removed after a reboot — if Malwarebytes asks you to restart, allow it. Once you’re logged back in, your Mac is clean.
Once the scan is done, remove every threat it detected. Your Mac is now free of adware, rogue browser extensions, and other potentially harmful software.
If your current antivirus allowed a malicious program on your computer, you might want to consider purchasing the full-featured version of Malwarebytes Anti-Malware to protect against these types of threats in the future. If you are still experiencing problems while trying to remove a malicious program from your computer, please ask for help in our Mac Malware Removal Help & Support forum.
Run a Malware Scan with Malwarebytes for Android
Malwarebytes for Android automatically detects and removes dangerous threats like malware and ransomware so you don’t have to worry about your most-used device being compromised. Aggressive detection of adware and potentially unwanted programs keeps your Android phone or tablet running smooth.
Download Malwarebytes for Android.
You can download Malwarebytes for Android by clicking the link below.
In the Google Play Store, tap “Install” to install Malwarebytes for Android on your device.
When the installation process has finished, tap “Open” to begin using Malwarebytes for Android. You can also open Malwarebytes by tapping on its icon in your phone menu or home screen.
Follow the on-screen prompts to complete the setup process
When Malwarebytes will open, you will see the Malwarebytes Setup Wizard which will guide you through a series of permissions and other setup options. This is the first of two screens that explain the difference between the Premium and Free versions. Swipe this screen to continue. Tap on “Got it” to proceed to the next step. Malwarebytes for Android will now ask for a set of permissions that are required to scan your device and protect it from malware. Tap on “Give permission” to continue. Tap on “Allow” to permit Malwarebytes to access the files on your phone.
Update database and run a scan with Malwarebytes for Android
You will now be prompted to update the Malwarebytes database and run a full system scan.
Click on “Update database” to update the Malwarebytes for Android definitions to the latest version, then click on “Run full scan” to perform a system scan.
Wait for the Malwarebytes scan to complete.
Malwarebytes will now start scanning your phone for adware and other malicious apps. This process can take a few minutes, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.
Click on “Remove Selected”.
When the scan has been completed, you will be presented with a screen showing the malware infections that Malwarebytes for Android has detected. To remove the malicious apps that Malwarebytes has found, tap on the “Remove Selected” button.
Restart your phone.
Malwarebytes for Android will now remove all the malicious apps that it has found. To complete the malware removal process, Malwarebytes may ask you to restart your device.
After the scan, tap Remove Selected to delete all detected threats. Your Android phone is now clean — no more malicious apps, adware, or browser redirects.
If your current antivirus allowed a malicious app on your phone, you may want to consider purchasing the full-featured version of Malwarebytes to protect against these types of threats in the future. If you are still having problems with your phone after completing these instructions, then please follow one of the steps:
Restore your phone to factory settings by going to Settings > General management > Reset > Factory data reset.
Now that your device is clean, keep it that way. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.
We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.
Is Docusign connected to this revised contract email?
No. The campaign impersonates Docusign and sends users to an unrelated lookaware[.]top host. The legitimate company did not create the phishing page described here.
Can a real Docusign document expire?
Envelope access and sender settings can vary, but an unexpected 24-hour warning must be verified. Open docusign.com directly or contact the sender through a known channel.
Which domains does Docusign use for official email and links?
Docusign advises users to look for its official docusign.com and docusign.net domains. Similar spelling, extra words, or another ending should be treated cautiously.
How can I open a document without clicking the email button?
Go directly to docusign.com and use Access Documents with the unique security code found in a legitimate notification. If no usable code or expected request exists, verify with the sender.
Where should I report a suspicious Docusign message?
Forward the email as an attachment to verify@docusign.com or use the Report Abuse option. Business recipients should also alert their security team.
What if the password was reused for my email account?
Change both accounts immediately from a clean device, revoke sessions, and review the mailbox for forwarding rules and password-reset activity. A reused credential expands the incident.
The Bottom Line
The DocuSign Approval Email Scam uses a believable revised-contract workflow and a 24-hour deletion warning to move recipients onto an unrelated login page. The business name and copied interface are not substitutes for an expected agreement and official domain.
Confirm the sender and contract through known records, or access a legitimate document from docusign.com with its security code. If lookaware[.]top or another imitation received your password, revoke access and report the campaign immediately.
10 Rules to Avoid Online Scams
Here are 10 practical safety rules to help you avoid malware, online shopping scams, crypto scams, and other online fraud. Each tip includes a quick “if you already got hit” action.
Stop and verify before you click, log in, download, or pay.
Most scams win by creating urgency. Verify using a trusted method: type the website address yourself, use the official app, or call a known number (not the one in the message).
If you already clicked: close the page, do not enter passwords, and run a malware scan.
Keep your operating system, browser, and apps updated.
Updates patch security holes used by malware and malicious ads. Turn on automatic updates where possible.
If you saw a scary “update now” pop-up: close it and update only through your device settings or the official app store.
Use layered protection: antivirus plus an ad blocker.
Antivirus helps block malware. An ad blocker reduces scam redirects, phishing pages, and malvertising.
If your browser is acting weird: remove unknown extensions, reset the browser, then run a full scan.
Install apps, software, and extensions only from official sources.
Avoid cracked software, “keygens,” and random downloads. During installs, choose Custom/Advanced and decline bundled offers you do not recognize.
If you already installed something suspicious: uninstall it, restart, and scan again.
Treat links and attachments as untrusted by default.
Phishing often impersonates delivery services, banks, and popular brands. If it is unexpected, do not open attachments or log in through the message.
If you entered credentials: change the password immediately and enable 2FA.
Shop safely: research the store, then pay with protection.
Be cautious with brand-new stores, “closing sale” stories, and prices that make no sense. Prefer credit cards or PayPal for dispute options. Avoid wire transfers, gift cards, and crypto payments.
If you already paid: contact your card issuer or PayPal quickly to dispute the transaction.
Crypto rule: never pay a “fee” to withdraw or recover money.
Common patterns include fake profits, then “tax,” “gas,” or “verification” fees. Another is a “recovery agent” who demands upfront crypto.
If you already sent crypto: stop paying, save evidence (wallet addresses, TXIDs, chats), and report the scam to the platform used.
Secure your accounts with unique passwords and 2FA (start with email).
Use a password manager and unique passwords for every account. Enable 2FA using an authenticator app when possible.
If you suspect an account takeover: change passwords, sign out of all devices, and review recent logins and recovery settings.
Back up important files and keep one backup offline.
Backups protect you from ransomware and device failure. Keep at least one backup on an external drive that is not always connected.
If you suspect infection: do not connect backup drives until the system is clean.
If you think you are a victim: stop losses, document evidence, and escalate fast.
Move quickly. Speed matters for disputes, account recovery, and limiting damage.
Stop payments and contact: do not send more money or respond to the scammer.
Call your bank or card issuer: block transactions, replace the card if needed, and start a dispute or chargeback.
Secure your email first: change the email password, enable 2FA, and remove unfamiliar recovery options.
Secure other accounts: change passwords, enable 2FA, and log out of all sessions.
Scan your device: remove suspicious apps or extensions, then run a full malware scan.
Save evidence: screenshots, emails, order pages, tracking pages, wallet addresses, TXIDs, and chat logs.
Report it: to the payment provider, marketplace, social platform, exchange, or wallet service involved.
These rules are intentionally simple. Most online losses happen when decisions are rushed. Slow down, verify independently, and use payment methods and account controls that give you recourse.
Hello! I'm Lapain Epuran, your go-to source for detailed and honest product reviews. From tech gadgets to miracle cures, I provide insights to help you make informed choices. Join me as we discover what's truly worth your time and money.
