Threat actors are abusing DocuSign's Envelopes API to create and mass-distribute fake invoices that appear genuine, impersonating well-known brands like Norton and PayPal.

DocuSign is an esign software platform that businesses can use to sign, send, and manage documents digitally - with “send” here being the keyword.