DocuSign's Envelopes API abused to send realistic fake invoices

Threat actors are abusing DocuSign's Envelopes API to create and mass-distribute authentic-looking fake invoices that impersonate well-known brands (e.g., Norton, PayPal). By using legitimate paid DocuSign accounts and the Envelopes:create endpoint, attackers bypass email security (emails originate from docusign.net), automate high-volume delivery, and seek e-signatures that can be used to authorize fraudulent payments; Wallarm documented the activity and reported it to DocuSign, which says it monitors and takes action against misuse.