Unconventional Cyberattacks Aim to Take Over PayPal Accounts

A phishing campaign was observed that abuses free Microsoft 365 test domains and distribution lists to send authentic-looking PayPal payment requests which pass SPF/DKIM/DMARC checks; when victims log in, attackers link and take over their PayPal accounts. The report details the technique, a real targeting instance, detection challenges, and suggested mitigations including user training and advanced email-security rules or AI-based detection.