In this article, you will learn how hackers steal PayPal passwords using phishing and social engineering.
Social engineering attacks are powerful because they often completely bypass security. If you can trick a user to enter a password into a fake page, it doesn’t matter how strong the password is.
So, the idea is to trick a person into revealing sensitive information. All you have to do is to make a fraudulent email message with a malicious link and send it to the victim so that he won’t suspect that it is fraudulent. To demonstrate the attack I will use a tool called “PyPhisher”.
Install PyPhisher
To install the tool, use the following commands in your Linux terminal.
git clone https://github.com/KasRoudra/PyPhisher
cd PyPhisher
pip3 install -r files/requirements.txt - break-system-packages
Run the Tool
To start PyPhisher type “python3 pyphisher.py” in the terminal, and you should get something like this:
As shown in the image above, you have over 77 website templates available on PyPhisher ready to launch phishing attacks. For this example, I will use the PayPal template by typing number 14.
Here you can see the phishing links. If the victim clicks on one of these links, a PayPal login page will be prompted to him.
In my case, I’m using the first link from Cloudflare. Now, here comes the next part where you need to use your social engineering skills and find a way to deliver this link to your target.
Phishing Email
Let’s say, for example, I have collected information about the victim and I know he/she has a PayPal account. So in this case, I can use the following phishing email.
In this email example, select the “log in” text and insert a malicious link from PyPhisher.
The link is suspicious, so you can hide it behind some text as a hyperlink or embed the link into a login button. If the victim clicks on the “log in” link, the PayPal login page will be prompted to him.
Let’s say he will enter ‘john67@gmail.com’ for the email and ‘letmein909’ for the password.
Once they click “Log In”, I will receive their login information on PyPhisher, while the victim will be redirected to the original PayPal login page.
Here you can see that I have successfully captured the login information from the victim.
Conclusion
Be very suspicious of any emails you receive, if the email contains a link, don’t click on it. Instead of clicking on the link, you can manually enter the web address into your browser to access the website.
Note: Please know that all the information is used to expand knowledge and not to cause malicious or damaging attacks.
Tags: cybersecurity training, network security courses, ethical hacking tutorials, web penetration testing, linux security training, online cybersecurity classes, wireless network security, learn ethical hacking online, linux for cybersecurity professionals.