A new report reveals that malicious actors are exploiting APIs in DocuSign to send fake invoices.