Loading story…
Fraudsters circulated PayPal-themed emails that falsely claimed unauthorized payments, including a $312.28 charge to BTC Trade Desk LLC and a $398.99 subscription payment, to pressure recipients into calling scam-operated phone numbers such as +1 (865)-386-0981 and 1-806-438-3451. The messages mimicked legitimate transaction notices with fabricated recipient, transaction, and profile details, using urgency and fear to convince targets that immediate action was required.
The scam calls reportedly led to impostors posing as PayPal customer service or technical support, with some attempting to gain remote access through tools such as AnyDesk or TeamViewer to steal money or personal information. Users were urged not to call numbers or click links in suspicious emails, to verify account activity only through PayPal’s official website or app, and to report phishing messages to phishing@paypal.com or through PayPal’s fraud reporting channels.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
A separate PayPal-themed scam email was reported that falsely said a $398.99 subscription had been paid and urged recipients to call 1-806-438-3451. The report said the scam used urgency and could lead victims to disclose information or install remote-access tools such as AnyDesk or TeamViewer.
A scam email impersonating PayPal claimed an automatic payment of $312.28 to BTC Trade Desk LLC and directed recipients to call +1 (865)-386-0981, which the report said was tied to scammers posing as PayPal support. The warning advised users to verify activity directly through PayPal and avoid calling numbers in suspicious messages.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Scammers exploited a loophole in PayPal’s subscription management feature to send legitimate emails from the official `service@paypal.com` address, tricking recipients with fake purchase notifications. By creating and then pausing a PayPal subscription, attackers triggered authentic PayPal notifications stating that an automatic payment was no longer active. These emails were manipulated to include alarming messages about expensive purchases and embedded fake customer support phone numbers, prompting recipients to call for assistance. The scam leveraged Unicode characters and formatting tricks to evade spam filters, making the emails appear more credible and difficult to detect. Victims who called the provided numbers were subjected to classic tech support fraud tactics, including remote access attempts and efforts to extract sensitive information or install malicious software. Following public reporting and investigation, PayPal closed the loophole to prevent further abuse of its email notification system for phishing and social engineering attacks.
Jun 29, 2026
Threat actors have been abusing **PayPal’s legitimate invoicing and alert mechanisms** to deliver phishing lures that bypass common email security controls and create urgency around supposed unauthorized transactions. By creating fraudulent PayPal business accounts and sending requests via PayPal’s own *Money Request/Invoice* workflow, the resulting messages can pass authentication checks and even display the BIMI **“blue tick”** indicator in some inboxes, increasing victim trust; the malicious content is placed in fields like `Note to Customer` and typically includes a **fake support phone number** to initiate a callback scam. In a related PayPal-themed campaign, victims who call the provided number are socially engineered into installing legitimate **remote monitoring and management (RMM)** tools so attackers can access systems and steal credentials. Reporting indicates operators initially used **LogMeIn Rescue** and later shifted to **AnyDesk**, a redundancy that can help sustain operations when tooling is blocked or detected; analysts warned that RMM-enabled access can be monetized beyond immediate fraud, including resale for broader enterprise compromise and potential ransomware deployment. Recommended mitigations include restricting outbound access to common RMM ports/tools where feasible, strengthening user verification procedures for payment-related emails (verify directly in PayPal rather than via email content), and reviewing third-party/RMM tool risk and monitoring for unauthorized installs.
Jun 29, 2026
Cybercriminals are distributing bulk phishing emails that impersonate well-known brands such as PayPal and HP to execute tech support scams. In one campaign, recipients receive a fake PayPal invoice from a Gmail address, with the email BCC'd to many targets and containing a suspicious attachment. The invoice claims the recipient has been billed $823 and urges them to call a phone number to dispute the charge, a tactic designed to create urgency and lure victims into contacting the scammers directly. The email passes SPF, DKIM, and DMARC checks because it originates from a legitimate Gmail server, but the sender address and lack of branding are clear indicators of fraud. A similar scam involves emails purporting to be from HP, including a PDF attachment and instructing recipients to call a provided phone number. The phone number connects to a generic call center that does not mention HP and instead attempts to engage the victim in a warranty renewal scam. These callback phishing schemes often use phone numbers that appear in multiple scam reports online and are answered by operators trained to adapt their script based on the brand the victim mentions. Both scams exploit technical authentication checks and social engineering to bypass suspicion and trick users into divulging sensitive information or making payments.
Jul 12, 2026