Abuse of Adobe Sign services more than doubled over a recent three-month period, signaling a shift toward sustained operations on high-reputation platforms. This trend represents a broader movement where attackers are no longer simply impersonating well-known brands but are actively weaponizing their legitimate infrastructure. For years, the security industry focused on identifying spoofed domains and look-alike URLs that attempted to mimic corporate services. However, in the current environment of 2026, the strategy has shifted toward “Living Off Trusted Services,” or LOTS. By using the actual notification systems of providers like DocuSign, SharePoint, and Google Drive, cybercriminals can bypass the most sophisticated email security filters. These platforms possess a high reputation and are often whitelisted by default, allowing malicious links to reach an employee’s inbox with an air of authenticity that traditional phishing could never achieve. This evolution marks a sophisticated escalation in cyber warfare, where the very tools designed for productivity have become the most effective delivery systems for credential theft and malware.
The Foundation: How Trust Becomes a Vulnerability
The core of the LOTS framework lies in the exploitation of the inherent trust and high reputation associated with established SaaS brands. These platforms are deeply integrated into daily business workflows, meaning that when an employee receives a notification from a service like Dropbox or SharePoint, their baseline level of suspicion is significantly lower. This psychological advantage is what makes SaaS-based phishing so effective; currently, one in ten phishing emails originates from a platform the recipient has been trained to trust for professional collaboration. The problem is not necessarily a security breach within the platforms themselves, but rather the systematic abuse of their intended features. Attackers leverage document sharing, automated invoicing, and free-tier account creation to route around the security perimeter. Because these services are essential for business operations, organizations cannot simply block them, giving attackers a reliable and persistent pathway into corporate environments.
The deep integration of these services into the modern workspace creates a “halo effect” where the security of the delivery mechanism is incorrectly equated with the safety of the content. When a user sees a notification from a familiar domain, they often skip the critical evaluation steps usually applied to external emails. Cybercriminals understand this human tendency and have optimized their campaigns to trigger these automated notifications. By creating a document or folder and “sharing” it with a target list, the attacker forces the SaaS provider to send a perfectly authenticated email on their behalf. This email carries the digital signatures and reputation of a multi-billion dollar technology company, making it nearly indistinguishable from a legitimate business request. This exploitation of professional social norms is the primary reason why LOTS has become a preferred method for sophisticated threat actors seeking to gain initial access to high-value networks.
Statistical Insights: The Rapid Rise of SaaS Abuse
Recent data highlights a clear upward trajectory in the volume of LOTS-based attacks throughout 2026. Out of hundreds of thousands of tracked threat emails, nearly 10% now utilize these techniques, and the volume is concentrated within a small selection of high-utility platforms. Document-share lures have become the dominant theme in phishing, representing nearly 40% of all tracked malicious emails. This concentration suggests that attackers are finding high success rates by focusing on a few specific tools that are ubiquitous in the corporate world. Platforms like DocuSign and QuickBooks are the primary targets for abuse, accounting for a vast majority of LOTS-specific incidents. There is a steady climb in the abuse of Adobe Sign and Dropbox as well, with some services seeing their malicious volume double or triple in a matter of months. This indicates that cybercriminals are moving away from short-lived, sporadic campaigns in favor of sustained operations on these high-reputation platforms.
The growth patterns observed since the beginning of 2026 suggest a high level of professionalization among phishing groups. Instead of casting a wide net with low-quality lures, these actors are specializing in platform-specific workflows. For instance, the rise in Dropbox-related phishing is directly correlated with the platform’s ability to host large files that bypass traditional attachment scanning. Statistics show that the success rate for these attacks is significantly higher than traditional domain-spoofing methods, as they successfully navigate the technical barriers of Secure Email Gateways. The persistence of these campaigns indicates that the return on investment for attackers is high, especially when targeting departments like finance and human resources. As the volume continues to rise, the data confirms that the era of “reputation-based security” is effectively over, as the most dangerous threats now arrive from the most reputable sources.
Platform Weaponization: Tailoring Lures to Trusted Tools
Different platforms are uniquely weaponized based on their functionality and the type of trust they command. DocuSign is favored for its “sign now” prompts, which create a sense of professional urgency regarding HR or finance matters. Interestingly, its link-expiration features, designed for security, actually aid attackers by making post-incident forensic analysis much more difficult. When a security team attempts to investigate a reported link, it may have already expired, leaving no trace of the malicious destination. Meanwhile, QuickBooks is often used for “payment received” lures that target financial departments during concentrated bursts of activity. These lures are particularly effective because they mimic the standard transactional emails that employees expect to see in their daily routine, making the malicious intent nearly invisible until the final stage of the attack is reached.
Google Drive and SharePoint are exploited through their collaboration features, such as @-mentions and automated comments. When an attacker shares a document and mentions a target, the platform triggers a genuine notification email with authentic headers and digital signatures. The email is technically perfect, but the embedded link leads to a credential harvester or a malicious script. These methods effectively turn the platform’s own notification system into a delivery mechanism for the attacker’s malicious intent. In many cases, the attacker does not even need to compromise an existing account; they simply use the platform’s free trial features to initiate the communication. This use of native collaboration tools allows the threat to reside entirely within the trusted cloud environment, making it invisible to security tools that only inspect traffic crossing the traditional network boundary.
The SaaS Abuse Kill Chain: Low Cost and High Success
The process for executing these attacks is remarkably low-cost and high-efficiency. Most SaaS platforms offer free tiers or trials that require only a few minutes to register, allowing attackers to set up shop with zero financial overhead. Once an account is created, the attacker uses the platform to share a document or send an invoice. The platform then generates a legitimate transactional email that carries all the necessary authentication markers, such as SPF, DKIM, and DMARC. These emails often gain a “fast lane” to the user’s inbox because many organizations maintain allow lists for major providers to ensure business-critical notifications are not delayed. The email itself remains clean and contains no malware, which means it will pass through most antivirus and sandboxing filters without triggering an alert. The maliciousness exists only at the end of a redirect chain initiated by a button or link within the notification.
By the time the user clicks, they have already been lulled into a false sense of security by the authentic origin of the message. The redirect mechanism is often sophisticated, using multiple layers of legitimate URL shorteners or cloud storage redirects to mask the final destination. This “clean” initial delivery is the hallmark of the LOTS kill chain. It relies on the fact that most security systems focus on the point of entry—the email—rather than the subsequent user journey. Since the entry point is a legitimate service, the security gates remain open. This creates a significant blind spot in traditional defense-in-depth strategies. Attackers have recognized that the path of least resistance into a secured network is no longer a technical exploit, but a legitimate email from a trusted partner that asks the user to perform a standard, everyday action like viewing a file.
Technical Exploitation: Bypassing Advanced Security Controls
Once a user clicks a link within a trusted notification, the attack typically follows one of three operational pathways designed to circumvent modern security. The most common is credential harvesting, where fake login pages capture usernames and passwords. More advanced versions use Adversary-in-the-Middle (AiTM) proxies to intercept authentication traffic in real-time, allowing the attacker to capture session cookies and effectively bypass traditional multi-factor authentication. Another growing technique is device code phishing, which exploits the OAuth authorization flow intended for devices without browsers. The victim is prompted to enter a short code on a legitimate identity provider’s site, inadvertently granting the attacker a live session token that provides persistent access to corporate data without ever needing a password.
Alternatively, some attacks trick users into downloading legitimate Remote Monitoring and Management (RMM) tools rather than traditional malware. Because these tools are digitally signed and used by actual IT professionals, antivirus systems and Endpoint Detection and Response platforms often fail to flag them as malicious. Once installed, these tools give attackers persistent, “hands-on-keyboard” access to the computer, allowing them to move laterally through the network at will. This method is particularly effective in 2026 as organizations have become more reliant on remote support tools, making the presence of such software seem normal to the average employee. The technical sophistication of these post-click actions ensures that even if the initial link is eventually flagged, the attacker has already secured a foothold that is difficult to detect and even harder to remove.
Strategic Response: Implementing Phishing-Resistant Defenses
Security practitioners observed that the most effective countermeasure involved a transition toward phishing-resistant multi-factor authentication. By moving away from standard push notifications and SMS codes, which were vulnerable to Adversary-in-the-Middle proxies, organizations successfully neutralized the primary goal of most SaaS-based attacks. The focus shifted toward hardware-backed credentials like FIDO2 keys, which required a physical connection to the device and could not be intercepted by a remote attacker. Furthermore, the implementation of behavioral AI tools allowed for the real-time analysis of message intent, flagging unusual urgency or irregular document-sharing patterns even when the sender address was technically legitimate. These steps created a multi-layered defense that prioritized the context of the communication over the reputation of the service provider, effectively closing the gap that attackers had exploited through the LOTS methodology.
The final layer of defense was the cultivation of a robust reporting culture among employees, supported by seamless internal tools. Training programs shifted from simple “click-test” scenarios to behavioral coaching that taught users to recognize the signs of social engineering regardless of the source. Organizations that successfully mitigated these threats were those that audited their allow lists and restricted the use of high-risk OAuth flows. By 2026, the industry recognized that static security controls were no longer sufficient for a cloud-integrated world. The transition toward a “verify-by-default” mindset, combined with technical restrictions on remote management tools, provided a sustainable path forward. These combined efforts ensured that while attackers continued to abuse trusted services, the window of opportunity for successful compromise was significantly narrowed, resulting in a more resilient and prepared corporate environment.