A comment from Randolph Barr, CISO at Cequence Security, in response to the news that threat actors are abusing DocuSign's Envelopes API to create and mass-distribute fake invoices impersonating well-known brands like Norton and PayPal.

"It's fascinating to see how sophisticated cybercriminals have become, leveraging legitimate tools like DocuSign to craft realistic phishing attacks. This highlights the importance of verifying the source of any document signing request, even if it appears to come from a trusted source. To combat these threats, organisations should prioritize ongoing security awareness training. This training should emphasise the importance of pausing and verifying before taking any action, even if it seems urgent. Additionally, IT and security teams must stay informed about the latest attack methods and techniques to effectively protect their organisations."