Unconventional Cyberattacks Aim to Take Over PayPal Accounts

Teilen:

Attackers are abusing a Microsoft 365 feature to send payment requests to users, tricking them into logging in to their accounts so attackers can seize control over them.

An unconventional phishing campaign convincingly impersonates online payments service PayPal to try to trick users into logging in to their accounts to make a payment; in reality, the login allows attackers to take over an account. The novel part of the attack is the abuse of a legitimate feature within Microsoft 365 to create a test domain, which then allows the attackers to create an email distribution list that makes the payment-request messages appear to be legitimately sent from PayPal.

Carl Windsor, CISO for Fortinet Labs, discovered the campaign when he himself was targeted by it, he revealed in a blog post published today.

Windsor received a request in his inbox from a sender with a nonspoofed PayPal email address seeking a payment of $2,185.96. The person requesting the money was someone called Brian Oistad, and aside from the “to” address not being Windsor’s email address —  it was addressed to Billingdepartments1[@]gkjyryfjy876.onmicrosoft.com —  there were few obvious signs it was not a genuine email, he said.

“What’s interesting about this attack is that it doesn’t use traditional phishing methods,” Windsor wrote. “The email, the URLs, and everything else are perfectly valid.”

That validity might persuade an average email user to click on the link in the email, which redirects them to a PayPal login page showing a request for payment.

Verwandt:Fake CrowdStrike ‘Job Interviews’ Become Latest Hacker Tactic

At this point, “some folks might be tempted to log in with their account details, however, this would be extremely dangerous,” he wrote. That’s because the login page links the target’s PayPal account address with the address it was sent to — Billingdepartments1[@]gkjyryfjy876.onmicrosoft.com, controlled by the attacker — not their own email address.

Abusing Microsoft 365 Test Domains for Cybercrime

The campaign works because the scammer appears to have registered a Microsoft 365 test domain — which is free for three months — and then created a distribution list containing target emails. This allows any messages sent from the domain to bypass standard email security checks, Windsor explained in the post.

Then, “on the PayPal Web portal, they simply request the money and add the distribution list as the address,” he wrote.

This money request is then distributed to the targeted victims, and the Microsoft 365 Sender Rewrite Scheme (SRS) rewrites the sender to, for example, “bounces+SRS=onDJv=S6[@]5ln7g7.onmicrosoft.com, which will pass the SPF/DKIM/DMARC check,” Windsor added.

“Once the panicking victim logs in to see what is going on, the scammer’s account (Billingdepartments1[@]gkjyryfjy876.onmicrosoft.com) gets linked to the victim’s account,” he wrote. “The scammer can then take control of the victim’s PayPal account — a neat trick … [that] would sneak past even PayPal’s own phishing check instructions.”

Indeed, abusing a vendor feature to deliver the phishing message does give the attackers a stealthy advantage when it comes to bypassing typical email security, a security expert notes.

“The emails are sent from a verified source and follow an identical template to legitimate messages, such as a standard PayPal payment request,” says Elad Luz, head of research at Oasis Security, a provider of non-human identity management. “This makes them difficult for mailbox providers to distinguish from genuine communications.”

Cyber Defense: Create a “Human Firewall” Against Phishing

Because the attack appears to be a genuine email, the best solution to avoid falling prey to it is what Windsor calls the “human firewall,” or “someone who has been trained to be aware and cautious of any unsolicited email, regardless of how genuine it may look,” he wrote in the post.

“This, of course, highlights the need to ensure your workforce is receiving the training they need to spot threats like this to keep themselves — and your organization — safe,” Windsor noted.

It is also possible to create a rule within email security scanners to “look for multiple conditions that indicate that this email is being sent via a distribution list,” to help detect a campaign that uses this vector, he added.

Another potential mitigation is to use artificial intelligence (AI)-based security tools that use neural networks to analyze social graph patterns, among other techniques, “to help spot these hidden interactions by analyzing user behaviors more deeply than static filters,” Stephen Kowski, field chief technology officer (CTO) at SlashNext Email Security+, tells Dark Reading.

“That kind of proactive detection engine recognizes unusual group messaging patterns or requests that slip through basic checks,” he says. “A thorough inspection of user interaction metadata will catch even this sneaky approach.”

Quelle

Kommentar verfassen

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert

lade-bild
London, GB
10:48 am, Juli 11, 2025
Wetter-Symbol 28°C
L: 26° | H: 30°
wenige Wolken
Luftfeuchtigkeit: 45 %
Druck: 1021 mb
Wind: 4 mph E
Windböe: 6 mph
UV-Index: 0
Niederschlag: 0 mm
Wolken: 13%
Regen Chance: 0%
Sichtbarkeit: 10 km
Sonnenaufgang: 4:56 am
Sonnenuntergang: 9:15 pm
TäglichStündlich
Tägliche VorhersageStündliche Vorhersage
Today 10:00 pm
Wetter-Symbol
26° | 30°°C 0 mm 0% 8 mph 47 % 1021 mb 0 mm/h
Tomorrow 10:00 pm
Wetter-Symbol
18° | 30°°C 0 mm 0% 9 mph 65 % 1018 mb 0 mm/h
So. Juli 13 10:00 pm
Wetter-Symbol
17° | 27°°C 0 mm 0% 7 mph 73 % 1014 mb 0 mm/h
Mo. Juli 14 10:00 pm
Wetter-Symbol
20° | 29°°C 0 mm 0% 14 mph 71 % 1017 mb 0 mm/h
Di. Juli 15 10:00 pm
Wetter-Symbol
15° | 27°°C 0 mm 0% 13 mph 71 % 1021 mb 0 mm/h
Today 1:00 pm
Wetter-Symbol
28° | 29°°C 0 mm 0% 3 mph 42 % 1021 mb 0 mm/h
Today 4:00 pm
Wetter-Symbol
30° | 31°°C 0 mm 0% 5 mph 32 % 1019 mb 0 mm/h
Today 7:00 pm
Wetter-Symbol
28° | 28°°C 0 mm 0% 5 mph 28 % 1017 mb 0 mm/h
Today 10:00 pm
Wetter-Symbol
22° | 22°°C 0 mm 0% 8 mph 47 % 1019 mb 0 mm/h
Tomorrow 1:00 am
Wetter-Symbol
18° | 18°°C 0 mm 0% 4 mph 55 % 1018 mb 0 mm/h
Tomorrow 4:00 am
Wetter-Symbol
19° | 19°°C 0 mm 0% 4 mph 65 % 1018 mb 0 mm/h
Tomorrow 7:00 am
Wetter-Symbol
19° | 19°°C 0 mm 0% 6 mph 64 % 1018 mb 0 mm/h
Tomorrow 10:00 am
Wetter-Symbol
24° | 24°°C 0 mm 0% 6 mph 45 % 1017 mb 0 mm/h
Name Preis24H (%)
Bitcoin(BTC)
€101,242.43
6.59%
Ethereum(ETH)
€2,583.20
8.65%
Fesseln(USDT)
€0.85
0.01%
XRP(XRP)
€2.22
6.12%
Solana(SOL)
€140.99
4.23%
USDC(USDC)
€0.85
0.01%
Dogecoin(DOGE)
€0.169050
8.62%
Shiba Inu(SHIB)
€0.000011
6.59%
Pepe(PEPE)
€0.000011
16.01%
Peanut das Eichhörnchen(PNUT)
€0.246894
20.17%
Nach oben scrollen