A new phishing campaign is underway, aiming to steal credentials from PayPal user accounts , as well as other sensitive information that can then be used for identity theft .
When PayPal detects suspicious activity on an account, the account is set to “restricted,” which will place temporary restrictions on withdrawing, sending, or receiving money.
The cybercriminals behind this phishing campaign are sending SMS messages that appear to come from PayPal. These messages state that a user’s account has been permanently restricted unless the user verifies their account by clicking on a link. Specifically, the message states the following: “PayPal: We have permanently restricted your account, please click on the link below to verify.” By clicking on the link, the user will be taken to a phishing page that asks them to log in to their account.
If connected to this page, the entered PayPal credentials will be sent to the cybercriminals. The page will then attempt to collect more information from the users, such as name, date of birth, home address, and banking details.
The information collected is then used to carry out identity theft attacks, access other user accounts, or carry out targeted phishing attacks.
Smishing scams are becoming increasingly popular, so it is important for users to be vigilant for any SMS containing suspicious links. As with all phishing messages, never click on suspicious links, but go to the domain to confirm if there is a problem with your account.
If you received this message and accidentally logged into your PayPal account or provided other information, you should immediately go to Paypal.com and change your password. Additionally, if you use the same password on other sites, you should change it on those sites as well.
You should also look for other targeted phishing campaigns using the submitted data . BleepingComputer also suggests monitoring your credit report to make sure no fake and “fraudulent” accounts are being created in your name. To prevent identity theft, you can also temporarily “freeze” your credit report so that banks or other companies cannot issue credit in your name.
