Beware: New Phishing Attack Using PayPal and Microsoft 365 Revealed

Imagine an email lands in your inbox—it looks legitimate. You see PayPal's logo, the subject seems professionally written, and even the email sender looks like the real deal. You don't think twice, log into PayPal to confirm the request, and BOOM: you've just handed your account over to a scammer. Unfortunately, this scary scenario isn’t hypothetical anymore. A new phishing technique is leveraging Microsoft 365 tools and PayPal’s own money request feature to con users out of their hard-earned cash.
Let’s dive deeper into how this clever phishing operation works, why it poses a significant threat, and what you, as a Windows and Microsoft ecosystem user, can do to protect yourself.

---

How Does This Scam Work?​

This phishing campaign is a masterclass in exploiting legitimate systems to bypass common security defenses. Thanks to a report by Fortinet and details from Infosecurity Magazine, here’s the dissection:

1. Microsoft 365 Test Domain Abuse:
   • The scammers start by cleverly registering free Microsoft 365 test domains. Microsoft 365 trial accounts provide legitimate functionality for enterprise-grade email services. Cybercriminals use this to create a “trusted” distribution list that contains the targeted email addresses. This subtle detail allows their phishing emails to fly under the radar of traditional anti-spam checks.
2. Leveraging PayPal’s Money Request:
   • Armed with their distribution list, scammers initiate a legitimate PayPal money request. The beauty—and irony—of this scam is that the phishing email originates from PayPal itself. Essentially, it uses PayPal’s own communication channels to target users. This method ensures the phishing email easily passes security checks and reaches a victim’s inbox looking authentic.
3. Sender Rewrite Scheme (SRS) Exploitation:
   • Here’s the real kicker: Microsoft’s Sender Rewrite Scheme (SRS), a tool designed to ensure emails don’t get flagged during forwarding, becomes the scammer’s secret weapon. SRS rewrites the sender’s address (to match PayPal’s trusted domain in this case) as the email gets processed, which neatly bypasses common email authentication measures like SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail). Recipients see an email that doesn’t just look trustworthy—it checks out in email client security panes.
4. The Panic-Driven Trap:
   • The email typically contains a clickable link urging the recipient to respond to this "money request." If the victim clicks and logs into PayPal, their credentials are immediately compromised, granting scammers access to their PayPal account.

It’s not hyperbole to call this an evolution in phishing methods. It blurs the lines between legitimate transactional emails and fraudulent ones. PayPal itself becomes an unwitting accomplice in delivering these poisoned messages.

---

The Challenges in Detecting This Technique​

Why PayPal and Microsoft Tools Make It Hard to Filter​

Standard phishing campaigns are often easy to spot because they involve poorly crafted emails or suspicious-looking sender domains. However, in this scenario:

• Authentic Sources: Both Microsoft 365 domains and PayPal’s email system are trusted by mailbox providers and users alike.
• Unmodified Template: The phishing email uses PayPal’s real money request format, so it is indistinguishable from a legitimate email.
• Passing Security Checks: Because SRS masks the real origin of the message and rewrites it during forwarding, most recipient systems classify it as non-malicious.

This is a classic case of “if it walks like a duck and quacks like a duck…”—even advanced spam filters are left scratching their heads.

---

Why This Attack is a Game-Changer​

This attack underscores a shift in phishing—one that forgoes brute force in favor of finesse. Instead of manufacturing fake messages, scammers now piggyback on the very systems users trust. It's a chilling reminder that even industry-leading platforms harbor vulnerabilities, not because their security is weak, but because they aren’t designed to anticipate such creative abuse.
Additionally, unlike most phishing schemes that prompt users to download malicious attachments or visit sketchy websites, this attack operates entirely within the bounds of legitimate platforms. Such sophistication poses a serious challenge for cybersecurity defenders.

---

Defending Yourself Against this Threat​

While Microsoft, PayPal, and other corporations continue to harden their defenses, here’s what individual users and IT teams can do to stay safe:

For Individual Users​

1. Verify All Payment Requests:
   • Stop, look, and verify. If you receive a money request via email, log into PayPal separately (don’t click on the link in the email) and check the request within your PayPal dashboard.
2. Enable 2FA (Two-Factor Authentication):
   • Even if attackers steal your credentials, two-factor authentication adds an additional layer of security. Use an authenticator app or SMS-based verification.
3. Scrutinize Sender Details:
   • Click the email sender information and double-check the email headers. If you’re unsure, forward the email to PayPal’s support team for verification.

For IT Teams and Businesses​

1. Train Your Human Firewall:
   • Every employee in your organization should receive training on phishing detection, especially for payment-related emails. Highlight this specific campaign during training sessions.
2. Implement Data Loss Prevention (DLP) Rules:
   • Configure your DLP settings to flag and monitor bulk emails involving known distribution lists or payment requests.
3. Use AI-Powered Email Security Tools:
   • Advanced tools with machine learning capabilities can identify oddities in group messaging and behavior patterns. These tools offer visibility into even the most subtle anomalies.
4. Stay Updated:
   • Regularly consult advisories from trusted cybersecurity organizations like Fortinet to keep ahead of evolving phishing techniques.

---

The Role of Technology in Staying Ahead​

Stephen Kowski, a field CTO at SlashNext, emphasizes that modern defenses can go beyond basic filters by leveraging AI and neural networks. These tools delve into a more profound understanding of user behavioral patterns. For example:

• Suspicious trends in distribution lists flagged from a test domain.
• Unusual requests originating but being routed via Microsoft SRS.

Such proactive approaches ensure that even deviously crafted scams don’t slip through the cracks.

---

Are PayPal and Microsoft Doing Enough?​

This scenario also raises important questions about the responsibilities of tech giants. As Elad Luz, head of research at Oasis Security, suggests, while it’s nearly impossible for email providers and PayPal alone to distinguish malicious activity in such cases, companies can invest more resources into tightening how features like money requests or domain testing are handled. Could PayPal impose extra verification steps for certain requests? Can Microsoft further fine-tune SRS to mitigate abuse?

---

In Summary: Stay Smart, Stay Secure​

This phishing technique is ingenious yet dangerous, re-emphasizing the importance of skepticism when dealing with financial communications. Whether you're a casual PayPal user or a professional managing robust IT systems, the mantra remains the same: Trust, but Verify. Always scrutinize before you act, and remember—the best defense against phishing is a cautious and informed user.
Let’s hear your thoughts: How do you check for phishing attempts? Are you confident in your email scrutiny skills? Share your experiences and tips below in the comments on WindowsForum.com! Together, we can build a stronger defense!

---

Source: Infosecurity Magazine Scammers Exploit Microsoft 365 to Target PayPal Users