On October 9, 2026, KnowBe4 Threat Lab published an analysis of a shift that redefines what a phishing email looks like. Out of 544,000 threat emails the team tracked between June and August 2026, 53,000 were built with a technique KnowBe4 calls Living Off Trusted Services, or LOTS. That is nearly one in every 10 threat emails, and none of them needed a spoofed domain, a forged logo or a suspicious sender address to reach the inbox.
The pattern is simple and cheap. The attacker registers a free account on a legitimate SaaS platform such as DocuSign, QuickBooks, Adobe or Dropbox, creates a document or invoice through that platform, and lets the platform’s own notification system deliver the email. The message is real in every technical sense. It comes from the platform’s genuine sending infrastructure, carries the platform’s branding, and is exactly the kind of automated alert an employee receives every working day. The only thing that is not genuine is the link behind the button.
The numbers behind the trend
DocuSign and QuickBooks alone account for nearly two-thirds of the LOTS volume KnowBe4 tracked, with document and payment lures dominating the picture. The month by month breakdown shows where attackers are heading. DocuSign grew every month of the three month window, which the researchers read as sustained abuse rather than a short lived campaign. Adobe volume grew over the same period, and Dropbox volume nearly tripled.
KnowBe4’s earlier Phishing Threat Trends Report Vol. 7, released in April 2026, put the industry level shift at 22% of all phishing attacks being sent through legitimate platforms, with attackers moving from impersonating a brand to abusing that brand’s actual infrastructure. The new Threat Lab numbers are a narrower, platform specific slice of that same movement, concentrated heavily in a handful of services.
The document-share theme is the single largest lure across phishing generally, accounting for 39.2% of the phishing emails KnowBe4 tracked. Most of those document lures never touch real platform infrastructure. The LOTS subset is smaller but far more dangerous precisely because it does.
Why SPF, DKIM and DMARC all pass
This is the part every email administrator should sit with. These emails pass sender authentication because the platform genuinely sent them. As KnowBe4 puts it, the email is clean because the platform sent it. DMARC proves that a message really came from the domain in the From line. When an attacker uses a real DocuSign account, the message really came from DocuSign. Every check that verifies sender authenticity returns green, and the malicious payload sits safely behind a button that leads off the platform entirely.
This is not a flaw in DMARC. RFC 7489 is explicit that the DMARC mechanism does not inform receivers whether an email stream is good, and authentication was never designed to judge the intent of a message that a trusted platform legitimately sent. What LOTS exposes is the boundary of domain authentication: it authenticates domains, not humans and not purposes.
The allow list problem
KnowBe4 identifies a second amplifier that organizations control directly. Many enterprises add high volume transactional senders such as major SaaS platforms to explicit allow lists in their secure email gateways, so contract notifications and invoice alerts never land in spam. When an attacker abuses a platform’s free tier to send a phishing notification, that message inherits the same fast lane through the allow list. The attacker pays nothing, registers an account in minutes and gets a pass that was originally earned by years of legitimate sending behavior.
Platform mechanics add further friction for defenders. DocuSign’s link expiration settings can make evidence vanish before an incident responder can review it, and on some platforms malicious documents stay live for days before a takedown request is processed.
What happens after the click
At the end of the redirect chain, KnowBe4 observed three main outcomes: credential harvesting pages that imitate Microsoft and Google sign ins, device code phishing that tricks victims into authorizing attacker controlled sessions, and remote access installer downloads. Some credential harvesting operations run through adversary in the middle proxies that capture session cookies and defeat ordinary MFA, which the researchers note holds unless phishing resistant methods such as FIDO2 hardware keys are enforced.
What this means for your DMARC program
The correct response to LOTS is not to question the value of authentication, it is to understand what layer of the problem each control solves. DMARC at enforcement remains the only reliable way to kill exact domain spoofing and lookalike impersonation of your own brand, and DMARC reporting remains your live inventory of everything sending as your domain. Neither of those controls can stop a genuine DocuSign notification, and no honest vendor will claim otherwise.
What you can do is attack the LOTS chain at its other links. Review gateway allow lists and replace blanket trust with policies that inspect the destination behind platform buttons. Train users that the sender being genuine says nothing about the request inside. Push phishing resistant MFA for the accounts attackers actually target with harvested credentials. And treat unexpected document and payment notifications, especially those referencing QuickBooks or DocuSign, as the highest risk category in your awareness program, because that is exactly where one in ten threat emails now lives.
Attackers who route through trusted platforms leave different traces, and your authentication reports still tell you who is speaking as your domain every day. Excello Mail turns your DMARC, SPF and DKIM data into a clear view of your sending landscape, so spoofing gets caught at the DNS layer while your team focuses on the attacks that authentication alone cannot stop. Sign up for free to Excello Mail and see your whole sending picture.