The PayPal Scam That Emailed You Your Own Password
ID: 7d5a6943-16c1-5b89-9114-318044530a5b
STIX ID: report--7d5a6943-16c1-5b89-9114-318044530a5b
Feed Name: IRONSCALES
A high-severity callback phishing campaign impersonated PayPal and delivered a fabricated username/password block plus a phone number to a senior executive; because the message originated from an authenticated unrelated domain (verificationemail.com) sent via Amazon SES with DKIM/DMARC alignment and contained no link or attachment, commercial gateways rated it benign. The report includes IOCs (verificationemail.com, [email protected], IP 23.251.232.55, phone 828-246-9290), maps to MITRE T1566/T1598, and emphasizes behavioral analysis to detect credential-disclosure and TOAD callback lures.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.