DocuSign Phishing Leads as 1 in 10 Threat Emails Use Real Platforms

A DocuSign phishing email used to mean a fake: a lookalike domain, a copied logo, a sender that failed a basic check. The version now filling inboxes is a real envelope from a real DocuSign account, opened in minutes on a free tier by someone you have never met. Your mail filter waves it through because, technically, nothing is wrong with it.

KnowBe4 calls the pattern Living Off Trusted Services, or LOTS. Its new numbers show how big it is, which platforms carry it, and why the advice to check the sender address no longer saves you.

Key Takeaways

• KnowBe4's Threat Lab says LOTS techniques accounted for 53,000 of 544,000 threat emails it tracked between June and August 2026, which it calls nearly one in every 10.
• DocuSign (32.27% of LOTS incidents) and QuickBooks (30.57%) together made up 62.84% of the volume, followed by Google Drive (11.30%), Adobe (9.29%) and SharePoint (5.63%).
• DocuSign, the largest platform, grew every month of the period, while KnowBe4 says Adobe more than doubled and Dropbox nearly tripled over the same three months.
• These notifications pass SPF, DKIM and DMARC because the platform really sent them; the malicious part sits behind a button that leads off the platform to a fake login, a device code prompt or a remote access installer.
• DocuSign's July 23, 2026 fraud alert describes real DocuSign envelopes posing as Intuit QuickBooks remittance notices, combining the two most abused brands in one lure.

What Is Legitimate Service Phishing?

Legitimate service phishing is when an attacker signs up for a real platform such as DocuSign or QuickBooks and uses it to send you a genuine notification that points to a malicious page. The KnowBe4 Threat Lab report sums up the economics in one line: "The attacker pays nothing, registers an account in minutes and gets a fast lane to the inbox."

KnowBe4 describes the chain the same way on every platform: "a free signup, a genuine notification and a redirect that only the attacker controls." Only the brand on the email changes from one campaign to the next.

Which Platforms Are Attackers Abusing Most?

DocuSign and QuickBooks, by a wide margin. KnowBe4's chart of confirmed LOTS incidents for June to August 2026 ranks eleven platforms:

• DocuSign, 32.27%: invoice approvals, wire transfers and HR onboarding, sent from dse@docusign.net.
• QuickBooks, 30.57%: fake payment confirmation and remittance notices from quickbooks@notification.intuit.com.
• Google Drive, 11.30%: document comments that @mention the victim.
• Adobe, 9.29%: document approvals and HR sign off requests.
• SharePoint, 5.63%: internal file shares.
• The long tail: Box 3.00%, WeTransfer 2.77%, Dropbox 2.74%, SurveyMonkey 1.27%, Notion 1.14% and Smash 0.03%.

Applied to the 53,000 total, those shares come to roughly 17,100 DocuSign lures and 16,200 QuickBooks lures in three months, by our arithmetic. KnowBe4 does not publish per platform counts. The trend lines differ too. DocuSign "grew every month," which KnowBe4 reads as "sustained abuse rather than a short-lived campaign." QuickBooks "peaked early before dropping and partially recovering," and its June bar is the tallest on the monthly chart.

Is Legitimate Service Phishing Actually Rising?

The report shows growth inside one quarter, not a year over year rise. Read the numbers with three caveats in mind.

• Two different denominators. KnowBe4's own Phishing Threat Trends Report Vol. 7 from April 2026 said 22% of all phishing attacks are sent through a legitimate platform. The new figure is 53,000 of 544,000, or 9.7%. The blog post calls the LOTS count "narrower," and does not reconcile the two, so 1 in 10 is not a drop from 22% and not a rise either.
• No baseline period. The title says rise, but the post compares June, July and August 2026 with each other and with nothing earlier.
• A small internal mismatch. The Adobe section says Adobe "grew faster than any tracked platform, more than doubling over three months." An earlier paragraph says Dropbox volume "nearly tripled." Both can only hold if growth is measured differently, which the post does not explain. Dropbox started from a much smaller base.

None of that weakens the main finding. A third of the abuse runs through one signing service, and that service kept growing for three straight months.

Why Do These Emails Pass SPF, DKIM and DMARC?

They pass because the platform really did send them, and that is all those checks measure. KnowBe4 puts it plainly: "The email is clean because the platform sent it."

The DMARC standard never claimed otherwise. IETF RFC 7489 says "The DMARC mechanism does not inform Mail Receivers whether an email stream is 'good'," and that DMARC "does not produce or encourage elevated delivery privilege of authenticated email." Authentication proves who sent a message. It says nothing about what the message wants from you.

Allow lists turn that gap into a fast lane. KnowBe4 says many organizations put high volume senders such as @docusign.net or @sharepoint.com on an explicit allow list so contracts never land in spam, which means an abused free account inherits the same pass. We saw the single campaign version of this in August, when NovaCookies used real Docusign emails for session theft, and earlier this month an iCloud spoofing flaw that also passed SPF, DKIM and DMARC.

What Happens After You Click?

KnowBe4 saw three endings at the far side of the redirect chain:

1. Credential harvesting. Buttons like "Review Document" or "Sign Now" leave DocuSign for fake Microsoft or Google logins, sometimes behind adversary in the middle proxies that capture session cookies and beat MFA "unless phishing-resistant methods, such as FIDO2 hardware keys, are enforced."
2. Device code phishing. The victim is asked to open an Adobe agreement and enter a short code on the real identity provider's site. They finish their own MFA and hand over "a live, already-authenticated session token."
3. Remote access tools. A fake document viewer installs ScreenConnect, AnyDesk or Atera, signed software that endpoint tools "rarely flag."

Why Email Users Should Care

Most anti phishing advice teaches you to read the sender address. For these lures that advice is worse than useless, because the address is correct and it reassures you. A QuickBooks invoice from quickbooks@notification.intuit.com is what a real invoice looks like; our QuickBooks email explainer calls that address a reliable fingerprint of a genuine QuickBooks send. In a LOTS attack, it is genuine.

Gmail users get a version that comes from Google itself. KnowBe4 describes attackers sharing a Google Doc, then posting a comment that @mentions you, so Google emails the comment from drive-shares-dm-noreply@google.com. The link inside "Google doesn't validate or restrict." It is the same move as the crypto phishing that rode Google's own account system emails in May.

The brands also stack. DocuSign's July 23, 2026 fraud alert says the notifications "originate from the Docusign platform and appear authentic," yet impersonate Intuit QuickBooks, with the subject line "Complete with Docusign: Outstanding Remittance Advise & Inv. xslx," the display name Accounts Payable, and a sender shown in the message body in the format quickbooks-notification.intuit.com@[random_domain].com.

How Do You Check a DocuSign or QuickBooks Email Before Acting?

Ask two questions: who inside the platform sent it, and where does the button go? A real envelope can still come from a criminal.

1. Open DocuSign yourself. DocuSign's fraud resources page says most envelope emails include a 32 character security code under Alternate Signing Method, which you can enter through Access Documents at docusign.com. Under LOTS, that only proves the envelope exists. It does not prove the sender is who the envelope claims.
2. Read the sender inside the message, not the From line. The From line will say DocuSign. The account that created the envelope appears in the body. Ask whether you expected anything from that person, and whether their address matches the company it names.
3. Hover every button, including those inside the document. DocuSign says real envelope links point to docusign.net, sometimes with prefixes like na2 or eu. KnowBe4's warning: if the destination "doesn't match the platform that sent the email, stop."
4. For QuickBooks, pay through a channel you already use. Intuit's security guidance says "Even if you know the sender, you should still be careful before clicking any links." DocuSign adds: do not click links, scan QR codes or call numbers inside the document; go to the vendor "using a separate, secure connection."
5. Report it. DocuSign asks that suspicious messages be forwarded as an attachment to verify@docusign.com. Tell your IT team too, because the next person may not hesitate.

Our DocuSign email breakdown lists which domains a genuine envelope uses, so you know what a clean link looks like before you hover.

What Should Security and Compliance Teams Change?

Stop treating platform reputation as a verdict. KnowBe4's own recommendations, plus one Microsoft control:

• Scope allow lists narrowly. If @docusign.net or @sharepoint.com sits on an explicit allow list, confirm it is still needed and scope it "as narrowly as possible instead of allow-listing the whole domain."
• Block device code flow where nobody uses it. Microsoft's Conditional Access guidance recommends organizations "get as close as possible to a unilateral block on device code flow."
• Alert on first time RMM installs on endpoints with no existing MSP relationship, rather than trusting the code signature.
• Enforce phishing resistant MFA such as FIDO2 keys, the condition KnowBe4 gives for AiTM proxies failing.
• Put payment changes behind a callback. KnowBe4's sender table shows DocuSign lures themed on invoice approvals and wire transfers. A finance policy that verifies any new remittance instruction by phone, on a number already on file, defeats the lure even when every header checks out.

For compliance teams, the audit question changes. A signed DMARC pass on an inbound contract proves the platform. It proves nothing about the counterparty, and the controls that matter now sit in finance procedures and identity policy, not the mail gateway.