The phishing scammers even linked to PayPal's CSS files in the HTML source of the original e-mail. We did not hotlink to PayPal's cascading style sheet, so the example above looks a bit different from the original one.



First they tell you what to do and THEN they greet you, with one of those generic "Dear customer" greetings. This should already tell you that you are not really dealing with an e-mail from PayPal. As a matter of fact if you paid any attention to the from address you should have noticed the typo in service@peypal.com. That gives the scam away immediately.



We still have trouble understanding how to download an attachment already attached to an e-mail, that has already been downloaded. Once you open the attachment, a web page will load in your browser, that looks exactly like the official PayPal website. You should notice that the address in the address bar does not point to paypal.com, but actually to a file on your computer's hard drive. Yes all the information you enter on this "web page" are collected on your computer and sent to a remote phishing site.

The first page of the phishing form looks like this:


Did you notice that the password is not masked? This is another sign that you are not entering the information on the real PayPal website.

The second page collects the following information:


Once again, a lot of personal information. The social security number is not validated in any way, so you can enter absolutely any rubbish in these fields.

The last page collects the following information:


We entered a random bunch of numbers and it became clear that the page only does some basic validation and does not really verify that the credit card number is valid. This is why it takes less than 30 seconds (because the form only collects data, it does not validate anything. Secondly, the form is hosted locally on your computer, so it is supposed to be fast).

The form submits the data to a remote website, either hacked or owned by the phishing scammers, then it redirects to the official PayPal website and since the scammers only collected your information, you should be able to log in as normal, just like the e-mail said. This is a very clever move by the scammers because the victim will continue using PayPal without suspecting a thing.

Phishing scammers are moving away from the old fashioned phishing method of including a link to the phishing site. Most phishing scams these days, involve some HTML attachment that has to be opened. Remember PayPal will never send you an e-mail requesting any form of personal information nor will they send you an e-mail with some HTML form attached to it.