Loading story…
Threat actors have been abusing PayPal’s legitimate invoicing and alert mechanisms to deliver phishing lures that bypass common email security controls and create urgency around supposed unauthorized transactions. By creating fraudulent PayPal business accounts and sending requests via PayPal’s own Money Request/Invoice workflow, the resulting messages can pass authentication checks and even display the BIMI “blue tick” indicator in some inboxes, increasing victim trust; the malicious content is placed in fields like Note to Customer and typically includes a fake support phone number to initiate a callback scam.
In a related PayPal-themed campaign, victims who call the provided number are socially engineered into installing legitimate remote monitoring and management (RMM) tools so attackers can access systems and steal credentials. Reporting indicates operators initially used LogMeIn Rescue and later shifted to AnyDesk, a redundancy that can help sustain operations when tooling is blocked or detected; analysts warned that RMM-enabled access can be monetized beyond immediate fraud, including resale for broader enterprise compromise and potential ransomware deployment. Recommended mitigations include restricting outbound access to common RMM ports/tools where feasible, strengthening user verification procedures for payment-related emails (verify directly in PayPal rather than via email content), and reviewing third-party/RMM tool risk and monitoring for unauthorized installs.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Socket's Threat Research Team identified five malicious Chrome extensions masquerading as productivity tools for platforms including Workday, NetSuite, and SAP SuccessFactors. The extensions, which had more than 2,300 users, were designed to steal authentication cookies and tokens, hijack sessions, inject cookies to bypass MFA, and obstruct access to security settings and audit pages.
In the PayPal-themed phishing campaign, attackers used phone-based social engineering to persuade victims to install legitimate remote monitoring and management tools, enabling credential theft and remote access. CyberProof reported the operators initially used LogMeIn Rescue and later switched to AnyDesk to preserve access if one tool was blocked or detected.
Attackers began abusing PayPal's legitimate invoice and money request features to send scam emails claiming unauthorized charges and urging recipients to call fraudulent support numbers. Because the messages are sent through PayPal, they can pass authentication checks and may display trusted branding indicators such as a BIMI verification mark.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcescworld.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat reporting has highlighted phishing-led intrusions in which attackers use legitimate remote monitoring and management (RMM) software to gain and retain access to victim environments. The approach can obscure malicious activity within approved administrative tooling, creating a material visibility gap for security teams and enabling adversaries to operate without deploying obviously malicious remote-access malware. The activity includes a U.S.-targeted phishing campaign and broader organized-cybercrime tradecraft that pair social engineering with RMM abuse. Organizations should treat unexpected RMM installation, new unattended-access configurations, and remote-control sessions initiated after phishing activity as high-priority signals; enforce application allowlisting and least privilege for RMM tools; and require strong authentication, centralized logging, and alerting for all remote-management access.
Sep 9, 2026
Fraudsters circulated PayPal-themed emails that falsely claimed unauthorized payments, including a **$312.28** charge to **BTC Trade Desk LLC** and a **$398.99** subscription payment, to pressure recipients into calling scam-operated phone numbers such as **`+1 (865)-386-0981`** and **`1-806-438-3451`**. The messages mimicked legitimate transaction notices with fabricated recipient, transaction, and profile details, using urgency and fear to convince targets that immediate action was required. The scam calls reportedly led to impostors posing as PayPal customer service or technical support, with some attempting to gain remote access through tools such as **AnyDesk** or **TeamViewer** to steal money or personal information. Users were urged not to call numbers or click links in suspicious emails, to verify account activity only through PayPal’s official website or app, and to report phishing messages to **`phishing@paypal.com`** or through PayPal’s fraud reporting channels.
Aug 7, 2026
A phishing campaign active since January 2026 has targeted victims in 46 countries—45% of observed activity involved the United States—using tax forms, Social Security notices, invoices, VAT, shipping, Adobe PDF, and shared-file lures. Victims are sent to short-lived pages hosted on services including Vercel, Netlify, Amazon S3, and DigitalOcean Spaces, or on compromised sites, then prompted to download password-protected ZIP archives. The archives use a VBS-to-PowerShell chain to retrieve signed installers for legitimate remote monitoring and management (RMM) products, giving operators interactive access without relying on conventional malware. The operators rotate among GoTo Resolve, LogMeIn Rescue, ScreenConnect, ConnectWise, and ITarian, limiting the value of product-specific blocking. Researchers identified 425 delivery-kit URLs across 240 hosts between February 5 and July 29, with 94% of hosts remaining live for only one day; stable kit artifacts included `fmtt` font files, `font1.woff2`, `icons8-microsoft-word-94.png`, and a `secure.html`-to-ZIP delivery chain. Organizations should detect and investigate unauthorized RMM deployments, particularly script-initiated PowerShell downloads of MSI installers, newly installed support software, and password-protected ZIP files delivered through phishing pages.
Aug 26, 2026