PayPal users targeted in account profile scam

A Malwarebytes analysis details a highly convincing PayPal phishing email campaign with the subject line “Set up your account profile.” The sender appears as service@paypal[.]com (sometimes from service@paypal.co[.]uk) but is spoofed, a technique used to disguise illegitimate messages.

The attackers use bulk phishing by targeting recipients via a distribution list, with unfamiliar sender addresses such as somebody@unknown-domain.test-google-a[.]com, signalling advanced phishing activity rather than official practice. The email claims a “New Profile Charge” of $910.45 USD at Kraken[.]com and urges action via a link that, when clicked, initiates the process to add a secondary user to the victim’s PayPal account, potentially allowing the scammer to drain funds.

PayPal has over 434 million active users, making the audience large for phishers, and the campaign appears to have been running for a month or more. To stay safe, users are advised to look for red flags, verify numbers and addresses, go directly to PayPal[.]com for messages, enable two‑factor authentication, and report suspicious emails to phishing@paypal[.]com. According to PayPal, these steps help reduce the risk of such scams.