Story image

Phishing scammers target PayPal in very well crafted attack, Proofpoint finds

07 Feb 17

Where there’s a will, there’s a way, and scammers are finding increasingly cunning ways to capitalise on the reach and popularity of the world’s global brands. This time PayPal is the target, according to Proofpoint.

The company recently discovered a phishing email message which looked like a benign PayPal login, but in reality it was a “very well crafted” phishing webpage. The page is available in multiple languages, which makes it seem all the more legitimate and across many different regions.

Behind the scenes, the phishing attack turned out to be complex and sophisticated, and Proofpoint says those are the real innovations.

The phishing attempts feature embedded URLs that direct users to the fake PayPal login.

Users who attempt to log in are dragged further into the phishing net, which only accepts genuine PayPal accounts. This is done using a decommissioned PayPal service that allows a person to buy a gift card from a user. The phishing attack then starts with a ‘reassuring welcome page’, Proofpoint says.

Users are then asked to confirm the credit card information. After the phishing kit validates the card, it asks users to enter security information about the card, the link to their bank account and details and identification.

After proceeding through a complete set of personal and financial information, the user then completes the scam and is directed to the genuine PayPal website.

Proofpoint says that the particular phishing kit shows how ‘crimeware as a service’ is rapidly advancing, and will become a more common technique.

Proofpoint says it has notified PayPal of the phishing campaign and the findings. 

How your enterprise backup solution could fail
Even the best-trained employees are prone to error, and unfortunately, sometimes those errors affect enterprise backups.
Xinja can now officially call itself a bank
The ‘neo’bank that is focused on being a digital disruptor to traditional financial institutions has received a restricted banking license from APRA.
Exclusive: Three access management learnings from 2018
There was a renewed global response to data security in 2018, placing pressure on organisations to assume more responsibility for the data they hold.
How businesses will pivot AI strategies to align with human-centric goals
AI will not only allow businesses to reduce costs but will also provide ROI to the staff working with the technology. 
HubSpot announces fund for 'customer first' startups
HubSpot is pouring US$30 million (NZ$40 million) into a new fund to support startups that demonstrate ‘customer first’ approach of not only growing bigger, but growing better.
Mac malware on WatchGuard’s top ten list for first time
The report is based on data from active WatchGuard Firebox unified threat management appliances and covers the major malware campaigns.
Using blockchain to drive transparency across the supply chain
"With blockchain, it’s likely we’ll see an increase in trust between organisations that work together through the supply chain."
Why businesses are struggling to reach digital maturity
Approximately 65% of respondents identified that they have yet to reach 'expert' status in their digital transformation maturity.