I'm asking this question out of curiosity; I haven't fallen victim to this, I'm just interested in what it does.
Today I have received an email from the "Paypal Security Team":
Dear Client,
After closely monitoring a number of unusual activities from your account, we decided to limit the access in the account.
Before we can restore your account back to normal, we need to get some information from you.
Please download and open the attachment file from this email. Furthermore, we ask that you complete the form that we have provided.
After doing so, we are then going to review your information and take the necessary steps to remove the limitations. Please understand that Account Limitations are applied to help keep you protected.
We apologize for the inconvenience.
Sincerely, PayPal
Here are the headers, with the IP of my email server removed because it's actually my own, private server:
From - Sun Sep 25 18:09:24 2016
X-Account-Key: account1
X-UIDL: 1:2267
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <[email protected]>
Received: from 210.115.225.25 (210.115.225.25) (HELO hallym.ac.kr)
by <myserver> (<myserverip>) with SMTP
id c2fb6dfb1b98664f; Sun, 25 Sep 2016 17:59:59 +0200
Received: from 96.53.84.19([189.149.72.109]) by hallym.ac.kr with SMTP id 160926005835170B; Mon, 26 Sep 2016 00:58:35 +0900
From: PayPal Security Team <[email protected]>
Subject: Suspicious activity
MIME-Version: 1.0
Message-ID: <[email protected]>
Content-Type: multipart/mixed; boundary="9bc43cfe03082750b916b2a227e24d86"
The message had a single attachment, an HTML file - this is the "form" mentioned in the message. In actuality, it's some sort of obfuscated JS code; I'm quite curious to find out what it does. It's available here; sorry that I link to an external source, but this is quite long. Presumably the user was supposed to open the file in their browser, which would execute the JS code and do something nasty.
I've tried to report this issue to PayPal, but "the page wasn't found".
What's slightly alarming about this is that I do possess a PayPal account, and that it is registered to the email address this message was sent to.
The interesting thing about the domain is that it seems to be very old:
Updated Date: 07-oct-2015
Creation Date: 01-dec-2003
Expiration Date: 01-dec-2016
I've checked a few whois
databases, with similar results.
- What does this do?
- Is this a new attack?
- How can I report this to PayPal?
- How come this was sent to an email address that's actually bundled to a PayPal account? Has there been a leak of some sort? Is this a coincidence?