Unusual phishing attack targets PayPal users

ArticlePosted onCarl Windsor, CISO of the cybersecurity company Fortinet, explains in a new blog post about a rather unusual phishing method with which he himself was confronted. This concerns a payment request sent via PayPal. The associated email comes from the sender [email protected] and appears legitimate at first glance. Even the link included points to a real PayPal URL.

Job market
IT Administrator – Infrastructure and Project Management (m/f/d)
City of Nürtingen, Nürtingen
IT Specialist / Product Owner (m/f/d) – digital health administration / digital specialist applications … (m/f/d)
Bavarian State Office for Health and Food Safety, Bad Kissingen
Detail
In fact, the mail also comes from PayPal. However, their sending was triggered by an attacker whose goal is to hijack other people’s PayPal accounts. According to Windsor, he registered a test domain with Microsoft 365 that could be used free of charge for three months and created an e-mail distribution list with the addresses of the attack victims.

He then used the function “Request money” at PayPal and entered the distribution address, so that the corresponding mail ended up in the mailboxes of all persons from the distribution list. Using Microsoft 365’s Sender Rewriting Scheme (SRS) feature, he also had the sender address rewritten to pass common security checks such as SPF, DKIM, and DMARC, Windsor explains.

Please do not log in
Recipients who click on the payment link in the e-mail land on a PayPal website with the created payment request and are asked to log in with their access data. According to Windsor, however, the respective PayPal account is linked to the attacker’s address by logging in, which is also visible on the login page. “The fraudster can then take control of the victim’s PayPal account,” warns the Fortinet CISO.

Display
Although PayPal warns against common phishing methods on its website, the scam described by Windsor is not covered. The fact that the payment request is sent via PayPal and thus via a trustworthy e-mail address is likely to inspire dangerous trust in many a recipient.

In addition, registering with PayPal alone does not trigger a payment, so some users could classify this step as harmless. With the process described by Fortinet, however, the account would already be hijacked.

Windsor considers the best protective measure to be “the human firewall” – i.e. the training of users to be careful with questionable e-mails, no matter how genuine links or sender addresses may look.

Advertisement: Click here for Hacking & Security: The Comprehensive Handbook at Amazon

Source