The IT Nerd

Researchers have uncovered a new PayPal phishing scam in which the scammers successfully spoof PayPal’s email address and use the email subject line of “Set up your account profile”.

Details can be found here:  https://www.malwarebytes.com/blog/news/2025/09/paypal-users-targeted-in-account-profile-scam

Here’s the TL:DR:

The sender address service@paypal.com (sometimes the emails come from service@paypal.co.uk) looks legitimate because it is, but the scammers have spoofed the address.

Basically, when someone sends an email, their computer tells the email system what address to show as the sender. Scammers take advantage of this by using special software or programs that let them type in any “From” address they want. This technique is called spoofing. The scammer sends their email through the internet, and since most email systems aren’t strict about checking this information, the fake sender address is displayed just like a real one would be.

So it’s hard for the everyday user to tell if the email has been spoofed or not.

Ensar Seker, CISO at cybersecurity threat intelligence company SOCRadar, commented:

“At first glance, it may appear like just another scam, but it highlights a growing sophistication in how attackers weaponize trust, familiarity, and urgency. What stands out in this case is the use of email spoofing combined with psychological pressure, a classic one-two punch. Spoofing the sender address to mimic PayPal adds a false sense of legitimacy, while the alarming message about a nearly $1,000 unauthorized charge triggers panic. This kind of emotional manipulation is exactly what makes phishing so effective: it hijacks the victim’s instinct to act before thinking. The attackers also cleverly obscure their tracks by using odd recipient addresses and distribution lists, likely to bypass simple recipient verification and to cast a wider net. That detail alone suggests this wasn’t a one-off email but a scaled campaign, which raises the stakes for detection and response.

From a technical standpoint, these types of threats bypass many traditional security controls, especially if there’s insufficient email authentication in place like lacking proper SPF, DKIM, and DMARC configurations. Organizations must ensure those protocols are correctly implemented to prevent spoofed emails from ever landing in inboxes.

On the user side, education remains vital. Even though the visual layout of the phishing email imitates PayPal’s design, a trained eye can spot the inconsistencies. But let’s be clear, users shouldn’t have to carry the burden of being the final line of defense. We need to build systems that assume attackers will get through and are resilient enough to stop damage downstream. We also need to treat email security as part of a broader threat intelligence operation. That’s why real-time visibility into spoofed domains, impersonation attempts, and phishing infrastructure is essential, not just for defense, but for proactive disruption.”

Organizations need to make sure that they are using DKIM, DMARC and SPF because it makes scams like these way less effective. The reason being that emails like these will end up either deleted or in the junk folder. Which means that you won’t be a victim. Hopefully the message gets through that this is no longer optional or a nice to have.

UPDATE: Roger Grimes, Data-Driven Defense Evangelist at KnowBe4 had this comment:

“Any time a scammer can use a legitimate site or service to send an email that is coming from that legitimate domain, it’s a problem. The popular advice of hovering over a link to inspect it before responding and performing the requested action fails. That’s why KnowBe4 teaches users two easy signs to look out for to detect a potential scam, and neither involves inspecting links or trying to determine if the site or service involved is legitimate. Our two-step recommendation is this: If you receive an unexpected message (no matter how received) and it’s asking you to do something you’ve never done before, research the request using an alternate trusted method (don’t rely on any contact or URL information in the original message) before performing the requested action. Any message with these two traits (unexpected and asking you to do something new) is at higher risk for being a scam than a message that does not have those two traits. So, while a message with those two traits might be legitimate, users need to recognize that any message with those two traits are at a higher risk than other messages and needs to be researched more before performing.”