Loading story…
Scammers exploited a loophole in PayPal’s subscription management feature to send legitimate emails from the official service@paypal.com address, tricking recipients with fake purchase notifications. By creating and then pausing a PayPal subscription, attackers triggered authentic PayPal notifications stating that an automatic payment was no longer active. These emails were manipulated to include alarming messages about expensive purchases and embedded fake customer support phone numbers, prompting recipients to call for assistance.
The scam leveraged Unicode characters and formatting tricks to evade spam filters, making the emails appear more credible and difficult to detect. Victims who called the provided numbers were subjected to classic tech support fraud tactics, including remote access attempts and efforts to extract sensitive information or install malicious software. Following public reporting and investigation, PayPal closed the loophole to prevent further abuse of its email notification system for phishing and social engineering attacks.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
A PayPal-themed scam used legitimate one-cent transactions, apparently tied to "Demetrus Techeck LLC," to place alarming messages in victims' accounts claiming a third-party wallet had been linked and a $980 payout was imminent. The messages urged targets to call a fake customer-service number connected to scammers, representing a different abuse method from the earlier subscription-email scheme.
By the following day, PayPal had closed the loophole that allowed scammers to trigger legitimate-looking purchase-related emails through its subscription feature. This action ended the specific abuse path described in the reports.
PayPal confirmed it was aware of the abuse, advised customers to use only official support channels, and said it was actively mitigating the problem. At that stage, the company had not publicly provided technical details of the fix.
Reporting revealed the campaign used a forwarding setup, likely a Google Workspace mailing list, to distribute the PayPal-generated emails to many victims. The scam then pushed recipients to call fake support, where operators attempted remote-access and tech-support fraud to steal money or data.
Scammers began exploiting PayPal's subscription and automatic payment notification workflow to generate genuine emails from service@paypal.com that referenced bogus expensive purchases and included fraudulent support phone numbers. The messages passed standard email authentication checks because they were sent from PayPal's own infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
5 references tracked. Mallory keeps watching after this page renders.
onlinethreatalerts.com
Open sourceonlinethreatalerts.com
Open sourceonlinethreatalerts.com
Open sourcemalwarebytes.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fraudsters circulated PayPal-themed emails that falsely claimed unauthorized payments, including a **$312.28** charge to **BTC Trade Desk LLC** and a **$398.99** subscription payment, to pressure recipients into calling scam-operated phone numbers such as **`+1 (865)-386-0981`** and **`1-806-438-3451`**. The messages mimicked legitimate transaction notices with fabricated recipient, transaction, and profile details, using urgency and fear to convince targets that immediate action was required. The scam calls reportedly led to impostors posing as PayPal customer service or technical support, with some attempting to gain remote access through tools such as **AnyDesk** or **TeamViewer** to steal money or personal information. Users were urged not to call numbers or click links in suspicious emails, to verify account activity only through PayPal’s official website or app, and to report phishing messages to **`phishing@paypal.com`** or through PayPal’s fraud reporting channels.
Aug 7, 2026
Threat actors have been abusing **PayPal’s legitimate invoicing and alert mechanisms** to deliver phishing lures that bypass common email security controls and create urgency around supposed unauthorized transactions. By creating fraudulent PayPal business accounts and sending requests via PayPal’s own *Money Request/Invoice* workflow, the resulting messages can pass authentication checks and even display the BIMI **“blue tick”** indicator in some inboxes, increasing victim trust; the malicious content is placed in fields like `Note to Customer` and typically includes a **fake support phone number** to initiate a callback scam. In a related PayPal-themed campaign, victims who call the provided number are socially engineered into installing legitimate **remote monitoring and management (RMM)** tools so attackers can access systems and steal credentials. Reporting indicates operators initially used **LogMeIn Rescue** and later shifted to **AnyDesk**, a redundancy that can help sustain operations when tooling is blocked or detected; analysts warned that RMM-enabled access can be monetized beyond immediate fraud, including resale for broader enterprise compromise and potential ransomware deployment. Recommended mitigations include restricting outbound access to common RMM ports/tools where feasible, strengthening user verification procedures for payment-related emails (verify directly in PayPal rather than via email content), and reviewing third-party/RMM tool risk and monitoring for unauthorized installs.
Jun 29, 2026
Cybercriminals are distributing bulk phishing emails that impersonate well-known brands such as PayPal and HP to execute tech support scams. In one campaign, recipients receive a fake PayPal invoice from a Gmail address, with the email BCC'd to many targets and containing a suspicious attachment. The invoice claims the recipient has been billed $823 and urges them to call a phone number to dispute the charge, a tactic designed to create urgency and lure victims into contacting the scammers directly. The email passes SPF, DKIM, and DMARC checks because it originates from a legitimate Gmail server, but the sender address and lack of branding are clear indicators of fraud. A similar scam involves emails purporting to be from HP, including a PDF attachment and instructing recipients to call a provided phone number. The phone number connects to a generic call center that does not mention HP and instead attempts to engage the victim in a warranty renewal scam. These callback phishing schemes often use phone numbers that appear in multiple scam reports online and are answered by operators trained to adapt their script based on the brand the victim mentions. Both scams exploit technical authentication checks and social engineering to bypass suspicion and trick users into divulging sensitive information or making payments.
Jul 12, 2026