Fake PayPal email wants you to bite

You might receive an email with a blank subject line that appears to be a PayPal account security notice. It uses PayPal branding, warns about detected account activity, and asks you to click a Review Account button. If it landed in your inbox, it would look like a routine security prompt designed to make you act quickly.

What gives it away is that the sending setup does not check out. Your email system could not properly verify that the message really came from who it claimed to be, which is a strong sign of spoofing. The domain behind it, avvv.fr, is old enough to look less suspicious at a glance, but age alone does not make it trustworthy, especially when the authentication fails and the message does not line up with the brand it is pretending to represent.

The attacker is trying to get your PayPal credentials, or any other details entered after you click through. If you engage, you could hand over your login, payment information, or other account data, which can then be utilised for account takeover, fraud, or follow-on scams against your business.

This is not an isolated one-off. The campaign has been seen across multiple Microsoft 365 tenants in the last day, which means other NZ organisations are likely seeing the same lure and it may keep resurfacing as attackers reuse the same branding and sender infrastructure.