Houston PayPal Users Beware: Sophisticated New Phishing Campaign Discovered

In a concerning development for PayPal users, Fortinet’s Chief Information Security Officer Carl Windsor has uncovered a sophisticated new phishing campaign that bypasses traditional security checks by exploiting legitimate PayPal features. Here’s what you need to know about this emerging threat and how to protect yourself.

  How The Campaign Was Discovered

The discovery came when Windsor himself received a suspicious payment request for $2,185.96 from a sender named Brian Oistad. Despite appearing legitimate at first glance, with valid PayPal sender addresses and URLs, a closer inspection revealed the email was addressed to an unusual Microsoft 365 domain rather than Windsor’s actual email address.

  How The Scam Works

This new phishing campaign is particularly dangerous because it doesn’t rely on traditional phishing tactics. Instead, the attackers:

1. Register a free Microsoft 365 test domain (valid for three months)

(Image via Fortinet’s FortiGuard Labs)

2. Create a distribution list containing target email addresses

3. Use PayPal’s legitimate money request feature to send payment requests to the distribution list

(Image via Fortinet’s FortiGuard Labs)

4. When victims log in to check the request, their PayPal account becomes linked to the attacker’s email address instead of their own

5. The attacker then gains control of the victim’s PayPal account

 What makes this attack especially deceptive is that it uses legitimate PayPal infrastructure – the emails come from real PayPal addresses, contain genuine URLs, and direct users to actual PayPal login pages. This allows the scam to bypass standard security checks and even PayPal’s own phishing detection systems.

  Protecting Yourself

To avoid falling victim to this and similar scams, experts recommend:

1. Always verify the email address in the “To:” field of any PayPal request
2. Never click links in unexpected payment requests, even if they appear legitimate
3. Access your PayPal account directly through PayPal.com or the official PayPal app
4. Enable two-factor authentication on your PayPal account
5. Report suspicious emails to PayPal’s security team at phishing@paypal.com
6. Remember that unexpected payment requests should always be treated with caution

 How CinchOps Can Help

To combat against sophisticated phishing campaigns, organizations need robust security solutions more than ever. CinchOps can help protect your business from sophisticated phishing attempts like this by:

• Implementing advanced email security filters that can detect suspicious distribution patterns
• Providing employee security awareness training focused on identifying complex phishing attempts
• Setting up multi-factor authentication across your organization
• Monitoring for unusual account activity patterns
• Establishing incident response procedures in case of compromise

Don’t wait until after an attack to strengthen your security posture. Contact CinchOps today to learn how we can help protect your organization from increasingly sophisticated phishing campaigns.

For immediate assistance or to learn more about our security solutions, reach out below or request a conversation on how to build both digital and human firewalls to protect your business from phishing. Together, we can build a strong defense against evolving cyber threats.