Researchers have uncovered a new PayPal phishing scam in which the scammers successfully spoof PayPal’s email address and use the email subject line of “Set up your account profile”.
Details can be found here: https://www.malwarebytes.com/blog/news/2025/09/paypal-users-targeted-in-account-profile-scam
Here’s the TL:DR:
The sender address service@paypal.com (sometimes the emails come from service@paypal.co.uk) looks legitimate because it is, but the scammers have spoofed the address.
Basically, when someone sends an email, their computer tells the email system what address to show as the sender. Scammers take advantage of this by using special software or programs that let them type in any “From” address they want. This technique is called spoofing. The scammer sends their email through the internet, and since most email systems aren’t strict about checking this information, the fake sender address is displayed just like a real one would be.
So it’s hard for the everyday user to tell if the email has been spoofed or not.
Ensar Seker, CISO at cybersecurity threat intelligence company SOCRadar, commented:
“At first glance, it may appear like just another scam, but it highlights a growing sophistication in how attackers weaponize trust, familiarity, and urgency. What stands out in this case is the use of email spoofing combined with psychological pressure, a classic one-two punch. Spoofing the sender address to mimic PayPal adds a false sense of legitimacy, while the alarming message about a nearly $1,000 unauthorized charge triggers panic. This kind of emotional manipulation is exactly what makes phishing so effective: it hijacks the victim’s instinct to act before thinking. The attackers also cleverly obscure their tracks by using odd recipient addresses and distribution lists, likely to bypass simple recipient verification and to cast a wider net. That detail alone suggests this wasn’t a one-off email but a scaled campaign, which raises the stakes for detection and response.
From a technical standpoint, these types of threats bypass many traditional security controls, especially if there’s insufficient email authentication in place like lacking proper SPF, DKIM, and DMARC configurations. Organizations must ensure those protocols are correctly implemented to prevent spoofed emails from ever landing in inboxes.
On the user side, education remains vital. Even though the visual layout of the phishing email imitates PayPal’s design, a trained eye can spot the inconsistencies. But let’s be clear, users shouldn’t have to carry the burden of being the final line of defense. We need to build systems that assume attackers will get through and are resilient enough to stop damage downstream. We also need to treat email security as part of a broader threat intelligence operation. That’s why real-time visibility into spoofed domains, impersonation attempts, and phishing infrastructure is essential, not just for defense, but for proactive disruption.”
Organizations need to make sure that they are using DKIM, DMARC and SPF because it makes scams like these way less effective. The reason being that emails like these will end up either deleted or in the junk folder. Which means that you won’t be a victim. Hopefully the message gets through that this is no longer optional or a nice to have.
UPDATE: Roger Grimes, Data-Driven Defense Evangelist at KnowBe4 had this comment:
“Any time a scammer can use a legitimate site or service to send an email that is coming from that legitimate domain, it’s a problem. The popular advice of hovering over a link to inspect it before responding and performing the requested action fails. That’s why KnowBe4 teaches users two easy signs to look out for to detect a potential scam, and neither involves inspecting links or trying to determine if the site or service involved is legitimate. Our two-step recommendation is this: If you receive an unexpected message (no matter how received) and it’s asking you to do something you’ve never done before, research the request using an alternate trusted method (don’t rely on any contact or URL information in the original message) before performing the requested action. Any message with these two traits (unexpected and asking you to do something new) is at higher risk for being a scam than a message that does not have those two traits. So, while a message with those two traits might be legitimate, users need to recognize that any message with those two traits are at a higher risk than other messages and needs to be researched more before performing.”
PayPal Pwned…. And They May Have Been Pwned For Months
Posted in Commentary with tags Hacked, Paypal on February 23, 2026 by itnerdPayPal recently disclosed a data breach that affected customers’ personal information and led to fraudulent transactions. Exposed information included names, email addresses, dates of birth, phone numbers, and business addresses combined with SSNs. What is more problematic is that according to this, this breach might have been a thing for about six months.
Ensar Seker, CISO at SOCRadar:
“This incident is a classic example of how “application logic flaws” can be just as damaging as external hacks. When sensitive financial workflows like loan applications are misconfigured, attackers don’t need sophisticated malware, they simply exploit business logic errors. The six-month exposure window is particularly concerning because it suggests monitoring and anomaly detection controls were either insufficient or not tuned to detect misuse at the application layer.
What stands out here is the downstream fraud. That means the exposed data was not just leaked, it was operationalized. Financial platforms must treat every internal workflow as an attack surface, especially those connected to credit, lending, and identity verification. Continuous validation, red-team testing of business processes, and behavioral fraud analytics are critical to prevent these quiet but highly monetizable exposures.”
Chris Hauk, Consumer Privacy Champion at Pixel Privacy:
“This data breach exposes how a coding error in an online application can expose customers’ data to hackers. Unfortunately, the breach exposed valuable information about PayPal customers, including business details, including the Social Security Numbers of those affected. Affected customers should closely monitor their credit lines and accounts, especially staying alert for new accounts. Hopefully, PayPal will offer some type of assistance for these customers to assist them in keeping track of their credit and financial accounts.”
Now I have had a look at my PayPal account and I don’t see anything unusual. And I strongly suggest that anyone with a PayPal account do the same as given the length of time that this was out there, the possibility that you might have been affected exists.
Leave a comment »