Filed under: Cybersecurity · Phishing · September 2026

What happened

Researchers at ANY.RUN are tracking an active phishing campaign called “CSuite.” About half of the victims they’ve seen are in the United States. The emails pretend to come from DocuSign, Adobe, Zoom, Google Meet, Dropbox, or Microsoft 365. In one example, the email was a fake DocuSign envelope from a law firm. After someone clicks, one of two things happens. Either the victim is tricked into handing over their Microsoft 365 login (sometimes by typing a “device code” on a real Microsoft page), or a small file quietly installs a legitimate remote-control program like ScreenConnect or Action1. That program gives the attacker ongoing access to the computer.

Why it matters to your business

With a stolen mailbox, attackers can read your real conversations with clients and vendors. They wait for an invoice or payment discussion, then step in and send new bank details that look completely normal. The remote-control tools are real business software, so antivirus often lets them run, and the attacker can stay connected long after the email is forgotten. For a Phoenix office that sends and receives payments by email, one click can turn into a wire that never comes back.

What to do this week

1. Tell your team two simple rules. A real DocuSign, Adobe, or Zoom link never asks you to download and run a file. And never type a code at microsoft.com/devicelogin unless you started the sign-in yourself on a device in front of you.
2. Block device-code sign-ins if you don’t use them. In the Microsoft Entra admin center, go to Protection → Conditional Access → New policy, then Conditions → Authentication flows → Device code flow, and set it to Block. This requires Entra ID P1, which is included in Microsoft 365 Business Premium. Test it in report-only mode first.
3. Look for remote-control software you didn’t approve. On each PC, open Settings → Apps → Installed apps and search for ScreenConnect (it may show as “ConnectWise Control”), Action1, AnyDesk, and similar tools. If your IT provider doesn’t use a tool you find, disconnect the PC from the network and call them.
4. Check mailboxes for warning signs. In Outlook, look under Settings → Mail → Rules for rules nobody created, especially ones that forward mail or move it to odd folders. If anything looks wrong, reset the password and have your admin sign that user out of all sessions (Microsoft 365 admin center → Users → select user → Sign out of all sessions).
5. Confirm every change to payment details by phone, using a number you already have on file.

The bigger picture

This campaign doesn’t break any software. It relies on a busy employee trusting an email that looks normal, then uses legitimate tools that security software trusts. Staff training, tighter sign-in rules, and knowing exactly what’s installed on your PCs are what stop attacks like this. → Phishing Attacks: Why SMBs Are Prime Targets and How to Fight Back

Would your team recognize a fake DocuSign email before clicking? Book a free consult → https://micro1tech.com/contact/