3 ms·
PayPal Cert Compromised? (Phishing Emails Signed w/ Valid Cert)
- poorman 4y agoLooks like people are receiving emails from a valid PayPal cert.
- zensayyy 4y agocert? that's an email. It's quite easy to change the mail from to be anything you want. Have a look on the dmarc fields if you want to be sure. Although I'm pretty sure that paypal always address the customer with their actual name...
- Thespian2 4y agoExactly. Need to see DMARC, SPF headers. Email headers are what you want to see. "From: <blah>" without those means nothing, and is trivially spoof-able.
- Thespian2 4y agoI don't see headers in the twitter post?
- downrightmike 4y agoHrm, They didn't respond to their akamai being hackable in a satisfactorily way. Researchers made a new page and inserted it into their paypal.com https://twit.tv/shows/security-now/episodes/891?autostart=false https://twit.tv/shows/security-now/episodes/891?autostart=fa...
- a3r0 4y agoIt looks like a real PayPal feature they're abusing by inserting their phishing message into a generic message field. They're aiming to get you to call that number No compromised cert needed