The bad guys are using Docusign look-alike emails to trick users into opening an infected email attachments.