New Phishing scam pretending to be PayPal

[Cathode]

Today I have had verified by F-Secure that an email I received is a fake. I have reported to PayPal a number of phishing emails and all of them have been verified as such. The difference with this one is that the attachment got through F-Secure. They have now given it a name on their database. The text of the email begins thus:

"Please update your PayPal account

Dear Client(s),

We're constantly working to make PayPal more professional, simpler and more convenient for our customers.
We will proceed update all our customers informations, and we will disable all accounts appear to be inactive.
Please help us to improve our services by giving your accurate information that will help us later in our project to improve our services."

There is an html file attached. Do not open it or follow any of the instructions. Other internet security companies may not have picked up on this yet. I informed F-Secure whose automatic screening drew a negative but now they have accepted this is a scam.

[vonpaso xlura]

Could you post the headers of the email?

[Cathode]

From: "Support PayPal" <[email protected]

Subject: Urgent Update Your Account PayPal (sic) note "Account" and "PayPal" are grammatically the wrong way round)

[Dotti]

Paypal phishing emails should be forwarded to [email protected]. Paypal has a security team that is dedicated to dealing with this type of thing, and as the party being misrepresented, they can typically get any phishing sites taken down faster than anyone else can.

[Cathode]

Thank you Dotti. I should have mentioned the email address. Not long after I received the fake PayPal email I received another one purporting to be from BT - quite likely from the same scammers. This one was also apparently not know to F-Secure at the time and has been ascribed a different Trojan name for the attachment. I am starting a new thread about the BT one but thought it worth mentioning it here as well. BT's site only seems to have a facility to report if one is a customer so they have not heard from me directly. The text of the fake email I received begins thus:

"Important: We need to confirm your BT account information.

Hello,
This e-mail has been sent to you to inform you that we were unable to confirm your BT account information.
This might be due to a recent change in your personal information. (eg: billing address, phone).
The secure way to confirm your account information:
Download the attached Document..
Follow the instructions to Confirm you account information..


You might need your BT account number for this you'll find it at the top of your bill. We'll send you a confirmation email once your account information verified.




Thanks for choosing BT,
Libby Barr
Managing Director, BT Sales and Service"