Akamai researchers discovered a new phishing kit targeting PayPal users with the goal of exfiltrating large amounts of personal information by employing social engineering techniques and mimicking security practices. Researchers identified this kit after the threat actor responsible planted it on their WordPress honeypot. Researchers discovered that the actor was brute forcing into legitimate WordPress websites that have previously been compromised in order to inject the phishing kit via a file management plugin. The actor then attempted to make the fraudulent website look professional by disguising it as the original PayPal site, including using the PayPal graphical interface elements and “htaccess” to rewrite the URL so it does not include the “PHP” file extension. The site also includes a CAPTCHA, which further assists in creating a false sense of security. When “unusual activity” is shown next with a prompt for the victim to “secure” their account, the page requests “a host of personal and financial details that include payment card data along with the card verification code, physical address, social security number, mother’s maiden name”, and more. The page takes this collection a step further by also prompting victims to submit government documentation, such as passports, national IDs, or drivers’ licenses, as well as photographs of the victim. This request is conducted with specific instructions, which is typical for a legitimate service like PayPal. Researchers noted one (1) unique aspect of the kit is its attempt to directly avoid security companies by “providing multiple different checks on the connecting IP address to ensure that it doesn’t match specific domains or originate from security organizations.” A deeper analysis into the newly discovered PayPal phishing kit can be viewed in Akamai’s report linked below.