Docusign API Abused in Widescale, Novel Invoice Attack

Security researchers observed a large-scale phishing campaign abusing DocuSign's API to send authentic-looking invoice requests from legitimate, paid accounts and templates. Because the messages are generated through DocuSign, they often evade spam/phishing filters and contain no malicious links or attachments; if signed or paid, they enable financial fraud. The report highlights mitigation steps for organizations (verify senders, internal purchase controls) and for providers (rate limits, threat modeling) to reduce API abuse.