Loading story…
Threat actors abused PayPal’s legitimate money request feature to send convincing emails with the subject “You’ve got a money request”, allowing the messages to appear authentic and evade some spam defenses. The malicious link was placed in the payment note as a Goo.gl URL, and victims who followed it were redirected through a download chain that ultimately delivered an obfuscated JavaScript file and then the Chthonic banking Trojan.
Proofpoint said the campaign was small in volume but notable for combining trusted-brand abuse, social engineering, and malware delivery in a way that increased the likelihood of user interaction. Analysis of the Chthonic sample’s infrastructure also showed delivery of a second-stage payload, AZORult, an information stealer advertised on underground forums as capable of harvesting passwords, cookies, cryptocurrency wallets, desktop files, Skype history, and host system details.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
In its analysis of the campaign, Proofpoint identified command-and-control infrastructure associated with the Chthonic sample and found that the malware also delivered a second-stage payload, AZORult. Proofpoint noted AZORult was an information stealer that was previously undocumented at the time of the report.
Proofpoint documented a low-volume campaign in which attackers used legitimate PayPal money request emails with the subject "You've got a money request" to send victims a malicious Goo.gl link. The link led through a download chain that delivered an obfuscated JavaScript file and then a Chthonic banking Trojan executable.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors have been abusing **PayPal’s legitimate invoicing and alert mechanisms** to deliver phishing lures that bypass common email security controls and create urgency around supposed unauthorized transactions. By creating fraudulent PayPal business accounts and sending requests via PayPal’s own *Money Request/Invoice* workflow, the resulting messages can pass authentication checks and even display the BIMI **“blue tick”** indicator in some inboxes, increasing victim trust; the malicious content is placed in fields like `Note to Customer` and typically includes a **fake support phone number** to initiate a callback scam. In a related PayPal-themed campaign, victims who call the provided number are socially engineered into installing legitimate **remote monitoring and management (RMM)** tools so attackers can access systems and steal credentials. Reporting indicates operators initially used **LogMeIn Rescue** and later shifted to **AnyDesk**, a redundancy that can help sustain operations when tooling is blocked or detected; analysts warned that RMM-enabled access can be monetized beyond immediate fraud, including resale for broader enterprise compromise and potential ransomware deployment. Recommended mitigations include restricting outbound access to common RMM ports/tools where feasible, strengthening user verification procedures for payment-related emails (verify directly in PayPal rather than via email content), and reviewing third-party/RMM tool risk and monitoring for unauthorized installs.
Jun 29, 2026
A series of sophisticated cyberattacks have targeted online payment systems and e-commerce users through phishing emails, malicious browser extensions, and large-scale web skimming operations. One campaign impersonated WordPress.com, sending convincing domain renewal emails that redirected victims to a fake payment portal designed to steal credit card details and 3-D Secure OTPs, with exfiltration occurring via Telegram. Another operation involved over 50 malicious scripts injected into checkout and account creation flows on e-commerce sites, using modular payloads tailored for specific payment processors like Stripe, PayPal, and Mollie, and leveraging fake domains to evade detection. In parallel, threat actors have deployed malicious browser extensions across Chrome, Edge, and Firefox, impacting millions of users by hijacking search queries, stealing data, and committing affiliate fraud. These extensions often remain dormant for extended periods before being weaponized through updates, further complicating detection. Collectively, these campaigns demonstrate a significant evolution in cybercriminal tactics, blending phishing, web skimming, and browser-based attacks to compromise sensitive financial and personal information at scale.
Jun 29, 2026
Scammers exploited a loophole in PayPal’s subscription management feature to send legitimate emails from the official `service@paypal.com` address, tricking recipients with fake purchase notifications. By creating and then pausing a PayPal subscription, attackers triggered authentic PayPal notifications stating that an automatic payment was no longer active. These emails were manipulated to include alarming messages about expensive purchases and embedded fake customer support phone numbers, prompting recipients to call for assistance. The scam leveraged Unicode characters and formatting tricks to evade spam filters, making the emails appear more credible and difficult to detect. Victims who called the provided numbers were subjected to classic tech support fraud tactics, including remote access attempts and efforts to extract sensitive information or install malicious software. Following public reporting and investigation, PayPal closed the loophole to prevent further abuse of its email notification system for phishing and social engineering attacks.
Jun 29, 2026