A DocuSign phishing email from a real insurance agent's hacked account fooled me, an IT professional with 30+ years of experience. Two-factor authentication saved my account. Then I traced the attacker to 188 domains across four countries.