PayPal Phishing

This report analyzes a PayPal-branded phishing campaign that used a URL shortener and newly-registered attacker domains (examples: phonedisney.com, meansfat.com, service-account.genuinelysmash.com) to collect login credentials, full PII (name, address, phone, SSN, mother’s maiden name) and validated credit-card details; the phish employed session-bound keys to prevent repeated analysis and ultimately redirected victims to the real PayPal site, and the author notes DNSWatch blocks these domains.