PayPal users are being targeted by a new phishing scam that aims to steal funds and take over accounts by tricking users with some very sophisticated fake emails. This new “account profile scam” was first covered in a blog post from Malwarebytes whose security researchers noticed that emails with the subject line “Set up your account profile” were being sent out to PayPal users.
However, the body of these emails often contained different instructions for each user – with the type of urgent language found in typical phishing emails like "this link will expire in 24 hours," or stating that an amount has been charged to the users account and needs to be disputed. Interestingly, they also provide targets with a button to click through to PayPal's actual site, where they would be led through to a command to add a secondary user. Since a secondary user can issue payments, the scammer could then drain the target's account.
