New PayPal subscription-exploiting email scam detailed

BleepingComputer reports that legitimate PayPal emails with fraudulent purchase notifications have been sent by exploiting the fintech platform's "Subscriptions" billing functionality as part of a new email scam.

Malicious emails sent from the "[email protected]" contained a message noting the inactivity of the target's automatic payment, along with a customer service URL altered to show expensive item purchases, the amount due, and a phone number where the transaction could be disputed or canceled in a bid to lure them into directly communicating with the scammers, according to BleepingComputer, which noted the emails to succeed in DKIM and SPF email security checks.

PayPal's rejection of additional text other than a URL to the customer service URL field led researchers to believe that the scheme may have been fueled by the abuse of a PayPal subscription metadata vulnerability or an API or legacy platform enabling invalid text within the field. PayPal has confirmed ongoing efforts to mitigate the security issue.