The popular online payment company PayPal has become aware of an unpatched vulnerability in its money transfer service that leaves unsuspecting users at risk for a social engineering technique known as clickjacking. Clickjacking, also known as UI redressing, is an attack that uses maliciously crafted webpages and webpage elements designed to look like legitimate sites to trick users into clicking on overlaid elements that download and execute malware, and/or type sensitive information into text boxes that redirect the user data to a command-and-control (C2) system. This is typically done by overlaying malicious HTML website elements on top of legitimate websites, via an HTML inline frame (iframe) used for embedding an HTML document within the current HTML document. Users may think they are clicking the “Login” button, when in reality they have clicked on an invisible malware link or a redirect that secretly sends the sensitive login information back to the C2. Security researcher “h4x0r_dz” first identified the vulnerability on the “paypal[.]com/agreements/approve” endpoint designed for Billing Agreements, and although it is only supposed to accept the “billingAgreementToken”, h4x0r_dz alleges that other token types work as well. An attacker could embed this vulnerable money transfer endpoint within a maliciously crafted HTML iframe, causing whatever funds are being sent to be redirected to an attacker-controlled PayPal account. Although this is a critical flaw on an individual PayPal account level, it poses an even greater risk to enterprise online payment portals that offer PayPal as a form of payment at checkout. In this case, a UI redress overlaid on a website PayPal checkout page could potentially send any PayPal transactions to an attacker-controlled account instead of the company’s payment account. Though h4x0r_dz reported the flaw to the PayPal bug bounty program in October of 2021 along with a Proof-of-Concept exploit, the flaw remains unpatched. The CTIX team will continue to monitor this matter and may provide an update once PayPal has made an official statement.