Phishing Campaign Abuses Legitimate Services to Send PayPal Requests

Fortinet and KnowBe4 describe a phishing campaign that registers free Microsoft 365 test domains, creates distribution lists of targets, and sends legitimate-looking PayPal money requests; Microsoft's SRS rewriting lets these emails pass SPF/DKIM/DMARC checks. If victims log into the linked PayPal portal, their account becomes associated with the attacker’s account, enabling account takeover; the report highlights that the attack leverages legitimate services at every step and recommends user training as the primary defense.