Scammers Are Sending Phishing Emails Through Real DocuSign, Google, and Meta Servers
Trend Micro, Wednesday, November 4th, 2026
Trend Micro describes phishing campaigns sent through genuine DocuSign, Google, Calendly and Meta features that pass email authentication.
TrendLife researchers tracked campaigns in which real accounts on real platforms send messages, so SPF, DKIM and DMARC checks all pass.
The deception sits in content platforms do not review, such as display names, renamed accounts or conversations, and the costly step usually happens elsewhere, like a phone call or a linked page.
In one DocuSign example, a fake PayPal invoice for a $650 crypto purchase included a dispute phone number.
Other DocuSign envelopes linked through legitimate redirects to fake Microsoft or Google Workspace sign-in pages, and the article explains how to spot each trick.