New PayPal Scam Tricks Users with Convincing Ads and Pages

Malwarebytes Labs uncovered a scam where attackers abuse compromised Google search ads and PayPal’s no-code checkout pay-link format (e.g., paypal.com/ncp/payment/[id]) to present convincing, fraudulent PayPal pages and phone numbers; the technique benefits from the legitimate paypal.com domain and is particularly effective on mobile devices where address-bar cues are harder to verify.