Phishing with PayPal Accounts

A phishing scam that involves hackers using PayPal accounts to send malicious invoices to potential victims discovered by the researchers from security firm Avanan

The scam involves hackers sending malicious invoices from PayPal’s domain, using a free PayPal account they have signed up for. The body of the emails sent spoof brands such as Norton to trick victims into thinking they were legitimate.

Resembling a similar scam that used fake invoices sent from Quickbooks detailed earlier this month, the PayPal invoices include messages such as “thank you for purchasing Norton Security Premium plan, if you have not authorized this transaction, please call us with your credit card details.”

Called a double spear attack, the scam makes the users call the number and, when it’s called, the hackers try to make the users pay the invoice, obtaining their credit card details in the process.

The researchers warn that anyone receiving an invoice should Google the number and check accounts to see if there were any charges. In a corporate setting, anyone receiving an invoice is urged to ask the information technology department about of the legitimacy of an email.