Recent data from KnowBe4 ThreatLabs indicates that approximately ten percent of all phishing traffic now originates directly from genuine platform infrastructure. This shift marks a significant departure from traditional cyberattack methods that relied on easily detectable domain spoofing or look-alike websites. In 2026, the digital threat landscape is defined by the strategic exploitation of the high-reputation infrastructure provided by ubiquitous Software as a Service (SaaS) providers. Attackers have recognized that the most effective way to bypass sophisticated security perimeters is not to break them, but to ride through them on the coattails of trusted services. This technique, commonly known as Living Off Trusted Services (LOTS), leverages the inherent credibility of platforms that modern businesses depend on for daily operations, effectively turning professional tools into delivery mechanisms for malicious intent.
The fundamental danger of this approach lies in the bypass of technical validation layers that organizations have spent years perfecting. Because the malicious emails are sent from the actual servers of companies like DocuSign or Google, they carry perfectly valid cryptographic signatures and pass all primary authentication checks. Security filters that once flagged suspicious sender addresses are now rendered ineffective against traffic that is, by all technical accounts, legitimate. This leaves the burden of detection almost entirely on the end-user, who must now distinguish between a routine notification and a targeted attack while operating within the high-pressure environment of a standard workday. As organizations continue to integrate more collaborative SaaS tools into their workflows, the surface area for these deceptive tactics expands, creating a persistent challenge for security teams and a lucrative opportunity for global threat actors.
The Psychology and Mechanics of SaaS Abuse
Why Exploiting Trust Is Highly Effective: Inherited Credibility
The success of service-lure phishing is rooted in the deep integration of SaaS platforms into daily corporate workflows where speed and efficiency are often prioritized over caution. In a typical business day, an employee might receive dozens of automated notifications regarding contracts, invoices, or collaborative edits from project management tools. This constant stream of communication creates an environment of inherited credibility, where users are conditioned to react quickly to notifications that arrive in familiar formats. When an email originates from the platform’s actual server, the recipient’s psychological defenses are significantly lowered. They are not looking for a scam because the medium itself has been established as a reliable component of their professional toolkit. The urgency often attached to these lures, such as a pending legal signature or a failed invoice payment, exploits this established trust to bypass critical thinking.
Why Exploiting Trust Is Highly Effective: Aesthetic Perfection
Beyond the technical validity of the sender address, the visual presentation of these phishing attempts is flawless because it utilizes the platform’s own templates. In 2026, attackers no longer need to spend time meticulously recreating brand logos or matching hex codes for buttons. By using legitimate trial accounts or free tiers on SaaS platforms, they trigger the actual notification system, ensuring that the email the victim receives is aesthetically identical to every other legitimate message from that service. This perfection removes the common red flags that security training programs have historically taught employees to identify, such as pixelated graphics or inconsistent fonts. The only malicious component is the destination hidden behind a genuine call-to-action button, which makes the initial interaction feel like a standard task rather than a security risk. This high-fidelity deception is a primary reason why LOTS campaigns achieve such high click-through rates.
How Infrastructure Is Compromised at Scale: Low-Cost Exploitation
The process of setting up a LOTS-based attack is remarkably low-cost and high-efficiency, making it an attractive option for a wide range of cybercriminals. Most major SaaS platforms offer free tiers or trial periods that require only a few minutes of registration to access sophisticated communication features. This accessibility allows attackers to register numerous accounts and use the platform’s native functionality to distribute their lures at scale without significant financial investment. By automating the registration and document creation process, threat actors can generate thousands of unique, platform-verified phishing emails in a single afternoon. This massive scale is difficult for SaaS providers to police in real-time, especially when the malicious activity is blended with millions of other legitimate users who are also signing up for free trials or small-business accounts every day.
How Infrastructure Is Compromised at Scale: Allow-List Blindness
A critical factor in the success of these campaigns is the widespread use of explicit “allow lists” within corporate email gateways. To ensure that essential transactional emails from services like DocuSign or SharePoint are never delayed or quarantined, security administrators often create broad rules that bypass deep inspection for these domains. Attackers exploit this administrative blind spot by ensuring their malicious notifications originate from the exact domains that have been granted these special permissions. Once a domain is whitelisted, the email passes through the gateway without any behavioral or content analysis, effectively creating a fast lane for phishing lures. This reliance on domain reputation rather than individual message intent has become a primary vulnerability in 2026, as the reputation of a platform is no longer a reliable indicator of the safety of the specific content being transmitted by a single user of that platform.
Bypassing Sophisticated Verification Protocols: Cryptographic Signatures
Because the phishing email is sent by the service’s own infrastructure, it carries legitimate cryptographic signatures that traditional security tools rely on to verify identity. Protocols such as Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) are designed to verify that the sending server is authorized to send mail on behalf of a domain. In a LOTS attack, the sender technically is the platform itself, so these checks pass perfectly every time. This creates a paradox where the very security protocols intended to protect the organization are actually being used to validate the attacker’s delivery mechanism. Security software that is programmed to trust any email with a valid DKIM signature will naturally allow these malicious messages into the inbox, as they meet every technical requirement for a “trusted” communication.
Bypassing Sophisticated Verification Protocols: The Reputational Shield
The use of high-reputation domains provides a technical shield that protects attackers from many automated defensive measures. If a security tool were to flag an IP address belonging to a major service like Google or Microsoft as malicious, it would risk blocking a massive volume of legitimate business communication, leading to significant operational disruption. Attackers understand that security vendors are hesitant to block these “too big to fail” domains, and they leverage this hesitation to ensure their links remain active and their emails stay deliverable. This reputational shield allows phishing campaigns to persist longer than those using newly registered domains, which are often blacklisted within hours. By the time a specific account on a trusted service is reported and suspended, the attacker has already achieved their primary objectives and moved on to a new account, continuing the cycle with minimal disruption to their operations.
Post-Click Operations and Specific Platform Trends
Techniques for Credential Theft and Session Hijacking: AiTM Proxies
Once a victim interacts with a link in a legitimate-service email, the attack moves into a highly technical compromise phase. Modern attackers frequently employ Adversary-in-the-Middle (AiTM) phishing proxies, which act as an invisible bridge between the victim and the legitimate login page of a service. As the victim enters their credentials, the proxy intercepts the data in real-time and relays it to the actual service. This allows the attacker to capture not only the username and password but also the live session cookies generated during the authentication process. In 2026, this technique has become the standard for bypassing multi-factor authentication (MFA), as the attacker can use the stolen session cookie to “clone” the victim’s authenticated state on their own machine. The victim believes they have simply logged into a document-sharing site, while the attacker has actually gained full, authenticated access to the user’s corporate identity.
Techniques for Credential Theft and Session Hijacking: OAuth Abuse
Another increasingly common method involves the abuse of OAuth device-authorization flows, which were originally intended to help users sign into accounts on devices without traditional browsers, such as smart televisions. An attacker initiates a device-code request and tricks the victim into entering that specific code on a legitimate Microsoft or Google authentication page. Because the victim is performing the authentication themselves on the actual platform site, the process feels entirely legitimate and often triggers the standard MFA prompt they expect. Once the victim confirms the code, they unknowingly grant the attacker a persistent, authenticated session token. This method is particularly dangerous because it does not require the attacker to steal a password; instead, it relies on the user voluntarily authorizing the attacker’s “device” as a trusted endpoint. This highlights the ongoing shift from stealing secrets to abusing legitimate authentication pathways.
Deployment of Remote Monitoring Tools: Establishing Footholds
In some targeted campaigns, the goal shifts from immediate credential theft to establishing long-term endpoint control through the deployment of legitimate Remote Monitoring and Management (RMM) tools. Attackers use SaaS lures to trick users into downloading and running installer scripts for software such as ScreenConnect, AnyDesk, or Atera. Because these are professional administrative tools frequently used by legitimate IT departments, they are almost always digitally signed by reputable developers and rarely flagged as malicious by traditional antivirus or Endpoint Detection and Response (EDR) software. Once the user runs the installer, the attacker gains a permanent, high-level foothold on the device, allowing them to monitor activity, steal sensitive files, and move laterally through the internal network. This tactic turns the organization’s trust in legitimate software against itself, making it incredibly difficult for security teams to distinguish between a valid IT session and a hostile intrusion.
Deployment of Remote Monitoring Tools: Lateral Movement
Once an RMM tool is successfully installed and communicating with the attacker’s command server, the threat evolves into a full-scale network breach. The attacker can use the administrative privileges of the RMM tool to deploy secondary payloads, such as credential dumpers or network scanners, to identify other vulnerable systems within the corporate environment. Since the initial entry point was a trusted SaaS platform and the subsequent activity is being conducted through a legitimate management tool, the internal security alerts are often minimal. Attackers in 2026 are increasingly patient, using these established footholds to conduct extensive reconnaissance before launching more disruptive actions like ransomware deployment or data exfiltration. The use of RMM tools essentially allows the attacker to act as a rogue system administrator, leveraging the very tools designed to keep the network running to eventually tear it down.
Analyzing Abuse Across Different Platforms: Volume Leaders
DocuSign remains the primary target for LOTS abuse, showing a consistent volume of malicious traffic that exploits the high-pressure nature of legal and financial sign-offs. Attackers favor this platform because its notifications are inherently transactional and often require immediate attention, which naturally rushes the user through their security checks. QuickBooks follows closely behind, with campaigns often focused on payment confirmations or invoices to induce panic in accounts payable departments. The concentration of abuse on these specific platforms suggests that attackers are carefully selecting services that are most likely to trigger an instinctive, rapid response from their targets. By focusing on high-utility platforms, they ensure that their lures are not just delivered, but are also relevant to the daily tasks of the employees they are targeting, increasing the likelihood of a successful compromise.
Analyzing Abuse Across Different Platforms: Rapid Growth Areas
While document-signing services lead in volume, platforms like Google Drive and Adobe Sign are seeing the fastest growth in abuse throughout 2026. Attackers are finding creative ways to use standard collaboration features, such as the “@-mention” or comment functionality, to trigger official platform notifications. When an attacker mentions a victim in a comment on a shared document, the platform sends a legitimate notification email containing the attacker’s malicious link. Because the email is generated by Google or Adobe, it bypasses almost every layer of traditional security. Furthermore, secondary platforms like Notion and SurveyMonkey are being repurposed to host highly convincing, legitimate-looking landing pages. These pages act as intermediaries, hosting the final phishing link on a trusted subdomain, which further complicates the efforts of security tools to block the malicious destination before the user clicks.
Modern Defensive Strategies and User Hygiene
Moving Toward Behavioral-Based Security: Intent Over Identity
As technical indicators like IP reputation and domain validity become increasingly unreliable, organizations are shifting their focus toward behavioral-based security models. This approach involves using artificial intelligence and Natural Language Processing (NLP) to analyze the actual intent of a message rather than just the integrity of the sender’s domain. Behavioral tools can identify anomalies that a human might miss, such as a mismatched context between the sender and the content of an invoice, or an unusual level of urgency that does not align with historical communication patterns. By evaluating the “linguistic fingerprints” of an email, these systems can flag suspicious notifications even when they originate from a perfectly legitimate platform. In 2026, the priority has transitioned from asking “who is the sender?” to asking “is the action being requested consistent with normal business behavior?”.
Moving Toward Behavioral-Based Security: Pattern Recognition
The implementation of advanced pattern recognition allows security teams to detect LOTS campaigns by observing how they interact with the entire organization rather than looking at a single message. While an individual DocuSign notification might look legitimate, a sudden influx of similar notifications from unrelated external accounts across multiple departments can be identified as a coordinated attack. Modern security platforms correlate these events in real-time, identifying the subtle threads that connect disparate phishing attempts. This macroscopic view is essential for defending against attackers who use multiple free accounts to spread their lures thinly across an organization to avoid triggering standard volume-based alerts. By focusing on the broader pattern of engagement, defensive systems can proactively block emerging threats before they reach the majority of the workforce, regardless of the reputation of the sending platform.
Auditing Infrastructure and Monitoring Installations: Narrowing Trust
To combat the abuse of trusted services, security administrators are re-evaluating their approach to allow-lists and global domain trust. The practice of granting “explicit allow” status to an entire domain is being replaced by more granular, scoped rules that subject even trusted traffic to continuous scrutiny. Organizations are now implementing policies that require every incoming link, even those from @docusign.net or @sharepoint.com, to be sandboxed or inspected for destination anomalies. This move away from broad trust ensures that the reputation of the platform does not serve as a permanent bypass for security controls. Furthermore, security teams are tightening their monitoring of OAuth authorizations, often disabling device-flow permissions for users who do not explicitly require them. This reduction in the “trust surface” is a critical component of a modern defense-in-depth strategy.
Auditing Infrastructure and Monitoring Installations: Contextual Alerts
Beyond monitoring the initial email, a robust defense in 2026 includes the continuous monitoring of endpoint activity to detect the early stages of a post-click compromise. Security operations centers are now prioritizing alerts that signal the first-time installation of RMM tools on endpoints, especially when those installations are not initiated by known administrative accounts. By adding a layer of contextual analysis to software installations, teams can identify when a legitimate tool like AnyDesk is being used as a backdoor rather than a support tool. This proactive monitoring extends to observing the creation of new OAuth tokens and the emergence of unusual session activity from new geographic locations. When the context of an action does not match the user’s typical profile, the session is automatically challenged or terminated, providing a safety net that protects the organization even when the initial phishing lure is successful.
The Shift to a Verify Before Trust Model: Direct Access Rule
The final and most resilient line of defense remains a workforce that has been trained to operate under a “verify before trust” mentality. One of the most effective strategies being adopted in 2026 is the Direct Access Rule, which encourages employees to bypass links in emails entirely when dealing with SaaS notifications. If a notification about a document or invoice is real, that item will be waiting for the user within their official account dashboard on the platform. By teaching employees to navigate directly to the service’s website via a known bookmark rather than clicking a link in an unsolicited email, organizations can effectively neutralize the primary delivery mechanism of LOTS attacks. This simple change in digital hygiene creates a physical barrier between the user and the attacker’s infrastructure, ensuring that the legitimacy of the notification is verified through an independent and trusted channel.
The Shift to a Verify Before Trust Model: Linguistic Vigilance
As attackers improve their ability to mimic corporate branding, user training has evolved to focus on the linguistic and situational red flags that persist even in perfectly formatted emails. Employees are now trained to recognize the “triage of deception,” which includes artificial time pressure, emotional manipulation, and unexpected requests for sensitive actions. When a user sees a DocuSign notification that demands a signature within two hours or threatens a service disruption, they are taught to treat the urgency itself as a technical red flag. This development of linguistic vigilance allows the workforce to act as a distributed sensor network, identifying the subtle social engineering tactics that modern AI-driven phishing campaigns rely on. In an era where technical signatures are no longer enough to guarantee safety, the human ability to perceive mismatched intent remains a vital component of institutional security.
The shift toward Living Off Trusted Services represented a fundamental change in the digital threat landscape that forced organizations to rethink their entire approach to email security. Attackers effectively bypassed traditional defenses by exploiting the same professional platforms that businesses used to maintain their daily operations. Throughout 2026, security professionals recognized that the technical reputation of a sender was no longer a valid proxy for the safety of the content being delivered. Success in this new environment was achieved by moving toward behavioral analysis, narrowing the scope of administrative trust, and prioritizing the human element through the Direct Access Rule. Ultimately, the industry learned that while platforms could provide a secure infrastructure, the responsibility for verifying the intent of every digital interaction remained a combined effort of sophisticated technology and a vigilant workforce. Actionable security in the coming years became less about blocking domains and more about understanding the nuances of how trust was being weaponized against the modern enterprise.
