Vicious PayPal phishing scam hijacks websites, steals your data

Online attackers are using dangerous malware to avoid all the security checks to steal victims' personal details through a Paypal phishing scam. Know how dangerous this phishing attack is.

Beware of this PayPal phishing scam which has potential to steal all your personal information. Know all about the malware that launches a phishing attack. (REUTERS)

Cybersecurity researchers have discovered a new phishing attack that deploys a dangerous malware to attack WordPress sites. A team of Akamai researchers have discovered this new malware that is being used by cybercriminals to execute a comprehensive PayPal phishing scam. This phishing attack forces victims to hand over their most sensitive information such as government documents, photos, and even banking information as well as email addresses to the attackers.

Akamai report also reveals that identity theft has claimed more than 42 million victims in America in just 2021.

Researchers say that the attackers use a file management WordPress plug-in to start the phishing attack. “The threat actor brute forces into existing, non-malicious WordPress sites and injects their Phishing kit into them as a way of maintaining evasion,” the blog post by Akamai mentioned. This includes several security checks on the connected IP addresses to escape the detection from the malicious domains. Not just that, it also allows the online fraudsters to rewrite URLs of the website without the .php at the end. This helps them to make it look more realistic just like the genuine addresses.

Once the malware is on the system, then the Paypal phishing scam comes into play while asking victims to escape all the security measures. The victim gets a captcha security challenge, this is another way in addition to the URL trick to make it look like a real PayPal login page. This is because users are accustomed to go through several security steps before logging in for payment details. However, this is a trap which allows online cybercriminals to simply steal all the information of the user's data, including email address and passwords. Later, this turns into the collection of credit card details as well as ATM details. At this stage, cybercriminals hold every important detail of the victim, along with document details.

More worrying part is that this planned and comprehensive level of identity theft can be used for several other crimes such as laundering money, evading taxes, or providing anonymity for other cybercrimes.