PayPal Spoofed in Credential Phishing Attack

January 15, 2021

PayPal is a well-known money transfer application, used often between friends and family as well as for small businesses. Because PayPal accounts are often linked to credit cards and bank accounts, the company itself is a commonly impersonated brand from attackers hoping to steal that information from unsuspecting victims.

In this attack, attackers use a method known as spoofing to impersonate PayPal, leading recipients to a phishing page.

Summary of Attack

  • Platform: Office 365
  • Bypassed Email Security: Ironport
  • Victims: Employees
  • Payload: Malicious Link
  • Technique: Spoof

Overview of PayPal Spoofing Attack

This email appears to be sent from PayPal (, which is a real PayPal domain), telling recipients that their account has been flagged and limited. However, authentication fails for this message and the actual sending domain is ‘’, a domain that has no correspondence to PayPal. The attacker is attempting to gain the trust of the recipient by making it appear as though PayPal has sent the email. This method—spoofing a real domain—can deceive the recipient into thinking the email is legitimate and coming from PayPal.

It may look as though the link within this email will take the recipient to, but the attacker uses a concealed link in an attempt to fool the recipient. When clicked, the link in the email actually leads the recipient to a phishing page at ‘’. This landing page looks nearly identical to the real website and asks the recipient to input their email or phone number and password.

For the casual observer, it'd be difficult to notice that this is a phishing site, as the only true indicator is the suspicious URL. If the recipient does click on the concealed link and input their credentials into this fake PayPal page, the attacker will then gain access to their PayPal account and all of the sensitive, personal information inside. For those unlucky victims with money sitting in the account, the attacker would be able to transfer those funds to an account under their control, or use the banking and credit card details to make purchases.

Why the Spoofed PayPal Attack is Effective

The attacker’s meticulous work in creating this fake PayPal website makes this attack very effective. The landing page may look nearly identical to the actual website, but the domain, ‘’, is, of course, not a PayPal domain. Without scrutinizing the real email address or the domain, the recipient may not notice that these are not actually from PayPal. Furthermore, because PayPal is commonly used for payment across the Internet, recipients who receive this may try to quickly fix their supposedly flagged and limited account, and therefore overlook signals that this is an email attack.

Abnormal was able to detect this malicious email due to a variety of factors, including the unusual sender domain and the suspicious link. In addition, the unusual authentication statuses and email sign off indicate that it may be malicious—causing Abnormal to block it before it reached end users.

To learn how Abnormal can block malicious emails for your organization, request a demo today.


See the Abnormal Solution to the Email Security Problem

Protect your organization from the full spectrum of email attacks with Abnormal.

See a Demo
Integrates Insights Reporting 09 08 22

Related Posts

B 1500x1500 Types of Email Platform Attacks L1 R2
Discover the most common types of email platform attacks in your cloud network and how you can prevent them.
Read More
B 1500x1500 Lilac Wolverine L1 R1
Threat group Lilac Wolverine is fine-tuning the art of exploiting people’s willingness to help others in some of the largest gift card attacks we've seen.
Read More
B 1500x1500 Modern Email Attacks Webinar Series L4 R2
Our Modern Email Attacks series has wrapped! Here are some of the biggest takeaways from Chris Krebs, Troy Hunt, and Theresa Payton.
Read More
B 1500x1500 Gartner Insights L1 R1
See our commitment to providing our customers with the best possible solution and support with these reviews from Gartner® Peer Insights™.
Read More
B 11 14 22 SPM Launch Blog Graphics
Security Posture Management gives organizations insight into cloud configuration risks and gaps across user and app privileges.
Read More
B 11 14 22 SPM Launch Blog 2
Cloud email platforms enable better collaboration, but they also create new entry points, making sensitive data more accessible to attackers.
Read More
B 1500x1500 Q3 Ransomeware L1 R2
This post explores the continuation of the sharp decline in ransomware attacks as well as a few other notable data points from Q3 2022.
Read More
B 10 05 22 Cloud Email Security Platform Essentials
Learn the 7 key capabilities a cloud email security platform should have in order to address and resolve common email security challenges.
Read More
B 11 07 22 Valimail
Discover the benefits of a modern, best-of-breed solution to email security with Abnormal Security and Valimail’s New Partnership.
Read More