New PayPal Phishing Abusing Microsoft365 Domains for Sophisticated Attacks

A phishing campaign has been observed in which attackers register Microsoft 365 trial domains and create deceptive distribution lists to send legitimate-looking PayPal payment requests that pass email authentication (SPF/DKIM/DMARC). Recipients who click the links are taken to convincing PayPal login pages, allowing attackers to link and take over accounts; the report highlights the tactic's ability to bypass standard detection and recommends verifying payment requests directly in PayPal and enabling 2FA.