SHARE

New Phishing Tactic Targets PayPal’s 434M Users

A new PayPal phishing scam adds attackers as secondary users, letting them drain accounts while evading traditional detection.

Written By

Ken Underhill

Sep 4, 2025

eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More

A new phishing campaign is targeting PayPal’s 434 million active users through highly deceptive “Set up your account profile” emails that grant attackers access to victim accounts.

Unlike typical lures, this campaign exploits PayPal’s own infrastructure to sidestep detection.

“The danger here is that a secondary user can issue payments,” wrote Pieter Arntz, a MalwareBytes researcher, in reference to this attack creating a secondary PayPal user. “In other words, the scammer would be able to clean out your PayPal account.”

How the attack works and why it matters

The attack begins with spoofed emails that appear to come from service@paypal.com or service@paypal.co.uk, urging victims to verify fabricated transactions of $910.45 at Kraken.com.

Upon clicking the link, victims are redirected to PayPal’s genuine infrastructure, where attackers insert themselves as secondary users. This tactic bypasses URL checks and traditional phishing defenses by leveraging legitimate PayPal domains.

From a technical standpoint, the campaign exploits weaknesses in email authentication by spoofing sender fields and abusing PayPal’s account delegation. The phishing emails look convincing, with authentic branding and urgent prompts, but Malwarebytes analysts flagged subtle red flags such as:

Odd “.test-google-a.com” addresses
Mismatched subject lines
Missing personalized greetings

Taken together, these elements show how attackers combine technical weaknesses with social engineering to increase their chances of success. By embedding themselves as authorized secondary users, attackers gain extensive privileges, such as initiating payments and draining balances.

Because the URLs resolve to trusted PayPal domains, both automated detection tools and end users often fail to recognize the activity as malicious. Analysts confirmed that the campaign has been active for over a month, spreading through compromised email databases linked to PayPal accounts.

The campaign marks a new phase in financial fraud. Instead of fake sites, attackers now exploit native functionality — making phishing harder to spot and more dangerous to enterprises. As financial platforms evolve, so must defenses, because the line between “legitimate” and “malicious” is blurring fast.

How organizations can respond

To counter these evolving tactics, organizations should adopt layered defenses and strengthen both technical controls and user awareness:

Train staff to spot spoofed PayPal emails and phishing tied to “secondary user” additions.
Encourage users to verify PayPal activity by logging in directly, not through email links.
Monitor transactions, network activity, and delegated privileges for unusual PayPal behavior.
Strengthen email authentication with SPF, DKIM, and DMARC to block spoofed senders.
Enable PayPal alerts for account changes, new users, and suspicious activity.
Enforce MFA on PayPal logins, restrict use to designated corporate accounts, and control access tightly.
Maintain incident response playbooks and audit account privileges across PayPal and other financial SaaS platforms regularly.

As phishing tactics grow more sophisticated, defenders must assume attackers will increasingly exploit trusted platforms rather than build obvious fakes.

The takeaway is clear: protecting financial accounts now requires vigilance against both external threats and the misuse of legitimate features that adversaries are turning into attack vectors.If attackers can twist PayPal’s own tools, imagine what a tailored spearphishing attack could do. Learn how to strengthen your defenses now.

Ken Underhill

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University and brings years of hands-on experience to the field.