PayPal Spoofed in Credential Phishing Attack

January 15, 2021

PayPal is a well-known money transfer application, used often between friends and family as well as for small businesses. Because PayPal accounts are often linked to credit cards and bank accounts, the company itself is a commonly impersonated brand from attackers hoping to steal that information from unsuspecting victims.

In this attack, attackers use a method known as spoofing to impersonate PayPal, leading recipients to a phishing page.

Summary of Attack

  • Platform: Office 365
  • Bypassed Email Security: Ironport
  • Victims: Employees
  • Payload: Malicious Link
  • Technique: Spoof

Overview of PayPal Spoofing Attack

This email appears to be sent from PayPal (, which is a real PayPal domain), telling recipients that their account has been flagged and limited. However, authentication fails for this message and the actual sending domain is ‘’, a domain that has no correspondence to PayPal. The attacker is attempting to gain the trust of the recipient by making it appear as though PayPal has sent the email. This method—spoofing a real domain—can deceive the recipient into thinking the email is legitimate and coming from PayPal.

It may look as though the link within this email will take the recipient to, but the attacker uses a concealed link in an attempt to fool the recipient. When clicked, the link in the email actually leads the recipient to a phishing page at ‘’. This landing page looks nearly identical to the real website and asks the recipient to input their email or phone number and password.

For the casual observer, it'd be difficult to notice that this is a phishing site, as the only true indicator is the suspicious URL. If the recipient does click on the concealed link and input their credentials into this fake PayPal page, the attacker will then gain access to their PayPal account and all of the sensitive, personal information inside. For those unlucky victims with money sitting in the account, the attacker would be able to transfer those funds to an account under their control, or use the banking and credit card details to make purchases.

Why the Spoofed PayPal Attack is Effective

The attacker’s meticulous work in creating this fake PayPal website makes this attack very effective. The landing page may look nearly identical to the actual website, but the domain, ‘’, is, of course, not a PayPal domain. Without scrutinizing the real email address or the domain, the recipient may not notice that these are not actually from PayPal. Furthermore, because PayPal is commonly used for payment across the Internet, recipients who receive this may try to quickly fix their supposedly flagged and limited account, and therefore overlook signals that this is an email attack.

Abnormal was able to detect this malicious email due to a variety of factors, including the unusual sender domain and the suspicious link. In addition, the unusual authentication statuses and email sign off indicate that it may be malicious—causing Abnormal to block it before it reached end users.

To learn how Abnormal can block malicious emails for your organization, request a demo today.


Prevent the Attacks That Matter Most

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Demo 2x 1

See the Abnormal Solution to the Email Security Problem

Protect your organization from the attacks that matter most with Abnormal Integrated Cloud Email Security.

Related Posts

B 05 13 22 Spring Product Release
This quarter, the team at Abnormal launched new features to improve lateral attack detection, role-based access control (RBAC), and explainable AI. Take a deep dive into all of the latest product enhancements.
Read More
B 05 11 22 Champion Finalist
Abnormal has been selected as a Security Customer Champion finalist in the Microsoft Security Excellence Awards! Here’s a look at why.
Read More
Blog series c cover
When we raised our Series B funding 18 months ago, I promised our customers greater value, more capabilities, and better customer support. We’ve delivered on each of those promises and as we receive an even larger investment, I’m excited about how we can continue to further deliver on each of them.
Read More
B 05 09 22 Partner Community
It’s an honor to be named one of CRN’s 2022 Women of the Channel. Here’s why I appreciate the award and what I love about being a Channel Account Manager at Abnormal.
Read More
B 05 05 22 Fast Facts
Watch this short video to learn current trends and key issues in cloud email security, including how to protect your organization against modern threats.
Read More
B 05 03 22
Like all threats in the cyber threat landscape, ransomware will continue to evolve over time. This post builds on our prior research and looks at the changes we observed in the ransomware threat landscape in the first quarter of 2022.
Read More
B 04 28 22 8 Key Differences
At Abnormal, we pride ourselves on our excellent machine learning engineering team. Here are some patterns we use to distinguish between effective and ineffective ML engineers.
Read More
B 04 26 22 Webinar Re Replacing Your SEG
Learn how Microsoft 365 and Abnormal work together to provide comprehensive defense-in-depth protection in part two of our webinar recap.
Read More
Blog mitigate threats cover
Learn about the most common socially-engineered attacks and why these tactics are still so successful—despite a growing awareness from employees.
Read More
B Podcast Engineering8
In episode 8 of Abnormal Engineering Stories, Kevin interviews Saminda Wijegunawardena, an engineering leader who is no stranger to fast-growing enterprise startups.
Read More
B 04 04 22 Webinar Recap Krebs
High-impact emails are on the rise and secure email gateways (SEGs) don’t have the functionality to mitigate them. Learn how your SEG is letting you down.
Read More
B 04 19 22 Facebook Phishing
While phishing emails have long been a popular way to steal Facebook login credentials, we’ve recently seen an increase in more sophisticated phishing attacks.
Read More