I had one a few months ago that came in as a docusign. The scammers created a REAL docusign. So the email that went to you came from docusign, not the scammers. Then within the docusign was the malicious link.
I've been hit with 3 of these, and they're usually pretty good. The scammers will scrape the USDA publicly available database and grab your REAL:
- Company Name
- Company Address
- Phone Number
- Organic Certificate number
Then use that to craft the email. All 3 times, our certifying body had a warning email out within the hour. So it looks like they'll do a mass campaign all at once.