# Zoom and DocuSign impersonation phishing campaign > Live situation record from CLSTR: https://clstr.news/situations/zoom-and-docusign-impersonation-phishing-campaign > Updated: 2026-09-21T02:03:00.000Z. Sources: 6. Developments: 2. Kaspersky has identified an active phishing campaign targeting corporate accounts by impersonating official communications from Zoom and DocuSign. The attack has proceeded in two distinct waves. The first wave utilized fraudulent DocuSign emails sent to corporate addresses across the Middle East, Latin America, Western Europe, Russia, Armenia, and Azerbaijan to facilitate credential theft via deceptive links. The second wave impersonates Zoom, sending urgent notifications that falsely warn users their accounts are about to be deactivated. This phase employs both phishing links and embedded forms to collect personal data and credit card information. As of September 11, more than 1,000 malicious emails related to this campaign have been detected. Security experts noted that these low-tech impersonation tactics remain effective because employees may overlook signs of fraud during high email volumes. Compromised accounts present a significant risk, allowing attackers to access sensitive data and move laterally within organizations. ## Timeline ### 2026-09-21: Kaspersky detects phishing campaign impersonating Zoom and DocuSign Kaspersky reports an active phishing campaign impersonating Zoom and DocuSign to steal corporate credentials and financial data across Latin America, Europe, and the Middle East. 3 sources. https://clstr.news/cluster/kaspersky-detects-phishing-campaign-impersonating-zoom-and-docusign-1 ### 2026-09-14: Kaspersky detects phishing campaign impersonating Zoom and DocuSign Kaspersky reports an active phishing campaign impersonating Zoom and DocuSign to steal credentials and credit card data through deceptive emails and fake account deactivation warnings. 3 sources. https://clstr.news/cluster/kaspersky-detects-phishing-campaign-impersonating-zoom-and-docusign --- Cite as: Zoom and DocuSign impersonation phishing campaign. CLSTR, https://clstr.news/situations/zoom-and-docusign-impersonation-phishing-campaign