The Rise of Legitimate-Service Phishing: 1 in 10 Phishing Emails Now Comes From a Platform You Trust
KnowBe4, Friday, October 9th, 2026
KnowBe4 Threat Lab measures how attackers abuse trusted platforms like DocuSign, SharePoint and Dropbox for phishing.
KnowBe4 Threat Lab analyzes phishing that abuses legitimate services such as DocuSign, SharePoint, Adobe Sign, Dropbox and Google Drive, a technique it calls Living Off Trusted Services (LOTS).
Its Phishing Threat Trends Report Volume 7 had found 22% of phishing attacks are sent through a legitimate platform, and in this analysis document-share lures were the largest theme at 39.2% of tracked emails.
LOTS-specific volume, about one in ten phishing emails, is concentrated heavily in a handful of platforms.