PayPal Impersonation Fake Billing Scam Attack
Initial Email Content
Dear Member,
You sent an automatic payment to ExpressVPN. Here are the details.
Automatic Payment Details:
Automatic payment number: K-D60C723G
Amount to be paid each time: $179.99 USD
Billing Cycle: Quarterly
Payment Start: 24 May 2022
Next payment Due: 23 Aug 2022
Next Payment Amount: $199.99 USD
Pay with Money from: PayPal
To change or cancel your agreement with ExpressVPN, log in to your PayPal account, go to your profile,
And click My Money and update your agreement in the “My preapproved Payments” section.
Do you confirm this payment?
Support: 1-857-293-0193
Click here to unsubscribe
Attack Screenshots
Malicious Artifacts
Additional Indicators of Compromise
Type
Description
Attack Description
This text-based fake billing scam impersonates PayPal using a fake payment receipt theme.