PayPal Phishing Nibble
Quick Answer
A PayPal phishing campaign caught in DuoCircle's spam quarantine illustrates the 'nibble' technique: each screen asks only for as much information as the victim is comfortable giving at that step, deferring more sensitive prompts (date of birth, full card details) to later screens that feel like routine verification. Across the full flow, the attacker would have collected PayPal credentials, physical address, full name, credit card number with CVV and expiration, and date of birth. The kit replicates the PayPal login on the first screen, then a 'verify your account' page for card details, then a 'Verified by Visa' page (with minor typos but accurate Verified by Visa branding) for the 3-D Secure step. Page transitions and loading states were polished enough to avoid suspicion.
I just ran across this site Phishing Site in our spam quarantine folder, the sender had targetted a few thousand users on the system over the course of a few days. The thing that I found most interesting about this particular Phishing site is what I like to call the nibble.
Each of the screens asked only for enough information to make you comfortable.
Nothing more, there was no asking for a birthday on the account validation screen, they waited until the next step in the process to ask for information that would immediately cause you to question the validity of the website.
They baited the hook and waited for the Phish to come. Please watch the video below.
Had it all worked I would have provided:
- PayPal Credentials
- Physical Street Address
- First / Last Name
- Credit Card, CVV and Expiration Date
- My Date of Birth
The only thing they did not ask for is mothers maiden name.
Initial Credentials Page.
This served to create trust, looks just like a PayPal login
Internal Page – Verify your account
The purpose here is to get you to verify your PayPal account, they already have your username and password to your actual PayPal account on the line before, but now they want your credit card info.
Internal Page – Verified by Visa
There are a few typos, but overall a great page. Nice touch using the Verified by Visa Logo.
I do have to mention that their “loading” and “transitions” between the pages were spot on target. I’ll give them an A for effort. If you’d like to educate your company on what to be on the lookout for when it comes to Spear Phishing please let us know.
General Manager
General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.
Secure your email infrastructure
Protect, authenticate, and deliver. Contact our team to find the right solution.