DOCUSIGN'S ENVELOPES API ABUSED TO SEND REALISTIC FAKE INVOICES

Summary from the TLDR InfoSec newsletter

Threat actors are using DocuSign's Envelopes API to send fake invoices impersonating well-known brands like Norton and PayPal. Attackers are bypassing email security protections to trick recipients into e-signing these documents to authorize payments. This large-scale abuse of the API has been reported to DocuSign.