PayPal scare email doing the rounds

You could receive an email with the subject line "Important notice" that looks like it comes from PayPal. It presents a dark, urgent security warning about restricted account access, says your account is at risk, and pushes you to "unlock" it now by confirming your identity before deactivation.

What makes this dangerous is that the message can appear technically clean enough to slip past basic checks, even though it is not from PayPal. The sending domain, stayatkoolina.com, is a real older domain with a clean reputation, which helps the scam look more believable in the inbox. That does not make it legitimate. It is still impersonating a different organisation, and the message content is designed to exploit trust in a recognised brand.

The attacker is after your PayPal credentials and any other details the fake sign-in page can capture. If you click through and enter your information, you can hand over access to your account, expose payment data, and potentially give criminals a foothold for further fraud against your business.

This has been observed across multiple Microsoft 365 tenants, so you are not the only one likely seeing it. Cross-tenant phishing keeps reappearing because the same lure can be reused widely, and a message that passes enough technical checks can continue reaching new inboxes.