Third-party phishing attack: malicious links

An analysis of a third-party phishing attack that uses Ellacard to attempt to trick users into following malicious links

By Alex Exarhos, March 28, 2026

Ellacard has been made aware of a third-party phishing attack that attempts to trick users into following malicious links.

What's going on

Ellacard offers the ability to add links and link-buttons directly in our cards. Malicious users are using that ability to create cards with links to phishing websites designed to look like legitimate companies (like DocuSign) that ask you to sign-in with legitimate services (like Microsoft). When you enter your credentials, these phishing websites will capture them and compromise your account.

Phishing example

Here's an example of a fake card. The attacker is pretending to be from a legitimate company, in this case impersonating a land surveying company, and has gone so far as to incorporate the logo as the envelope stamp, background, and inside the card itself.

What have we done about it?

Ellacard takes security very seriously and we want to protect our users. As such, we've taken several steps to mitigate this issue:

• Added properties to the links / buttons that tell your browser and third-party analysis tools that these links are user-generated content, specifically rel="noopener noreferrer ugc nofollow" (these properties were already present in some cases, but importantly not the button featured in the example above)
• Developed a system for blocking cards / invitations that contain harmful content. Flagged orders will not be accessible via public links – group-signers and recipients will see the following message: Harmful / malicious content warning
• Implemented a process for automatically scanning user content for malicious links when a card / invitation is modified. Our process checks Google's web risks API and queries OpenAI as a fallback to determine if a link is suspicious, in addition to some of our own internal logic.
• Dynamically scan links when followed – when you click on linked text or a button in a card / invitation, rather than being directly navigated to the target site, the link will first be evaluated for risk with three potential courses of action:
  • Known valid links will open directly, maintaining the current seamless user experience
  • Links that get flagged as potentially suspicious will ask you to confirm navigation before continuing Handling of potentially suspicious links
  • Highly suspicious links will get outright blocked Handling of highly suspicious links

What can you do about it?

Be aware of scams like these and be cautious when following unrecognized links. Do not enter your credentials on websites you don't recognize or when you weren't expecting to be prompted for them. Check the URL in your browser's bar – in this case, the phishing website was masquerading as DocuSign, however the URL did not end in "docusign.com" and was quite long.

If you see anything suspicious, please reach out as soon as possible. We take these incidents very seriously and will address them promptly: support@ellacard.com