Happy Friday
This past week we've received a surge of reports of scam emails breaking through spam filters. Bad actors have been focused on finding ways to use legitimate services to break through spam barriers and trick us into giving them access to our accounts. But not you, since you're reading this and strengthening your human firewall!
The latest "big one" comes from a vulnerability currently being exploited in PayPal. The email scam exploits the platform's address settings to send fake purchase notifications, tricking you into panicking and giving scammers access to your computer.
It starts with an email from PayPal stating, "You added a new address. This is just a quick confirmation that you added an address in your PayPal account."
The email includes the new address that was allegedly added to your PayPal account, including a message claiming to be a purchase confirmation, like this:
Emails are being sent from a real PayPal address "service@paypal.com," which might lead you to believe that your account was hacked. After all, the emails are legitimate PayPal emails, bypassing security and spam filters.
The scammers are trying to get you to:
1) Believe that your account was hacked
2) Call the scammer's "PayPal support" phone number
3) Have a "customer support" person "help you out" by having you download and run software for them to "help" you regain access to your account
And we're back to familiar territory here. Once the threat actor gains access to the computer, they attempt to steal money from bank accounts, deploy malware, or steal data from your computers.
The Takeaway
What a mystery right? A legitimate email from PayPal from a scammer making its way to your inbox - how is this possible?
It turns out that PayPal allows you to send "gifts" to others using their platform. The problem is that there is no character limit in the "gift address" field. Scammers are exploiting this flaw this by stuffing in alarming messages and fake tech support numbers, making their scams look like real PayPal notifications.
How to protect yourself:
1) Ignore any PayPal email claiming you added a new address if it also includes a suspicious purchase confirmation.
2) Do NOT call the phone number in the email—it belongs to a scammer.
3) Log in to PayPal directly (not through links in emails) and check your address settings. If nothing was changed, you're fine—junk the email.
PayPal is aware of this exploit and should patch it soon. But in the meantime, spread the word to keep your family, friends and co-workers safe.
Stay safe out there. -Attila
New Friday Funnies
Why can't the Vatican accept Visa or Mastercard? Because it's a PayPal state Money is the root of all evil. To learn more, please send $100 to my PayPal account :)
Comments