PWS:HTML/Phish.BE is a password-stealing malicious webpage, known as a phishing page, that disguises itself as a legitimate PayPal webpage.

PWS:HTML/Phish.BE attempts to steal your banking and PayPal account information by tricking you into filling out your details in a form on a fake page, and then sending that information to a remote attacker.

It may use images, logos and layouts that the authors of PWS:HTML/Phish.BE have copied from an authentic PayPal site.

Identifiable symptoms

The following may indicate the presence of PWS:HTML/Phish.BE:

• An email inviting or requesting you to fill in your PayPal account details (including your bank details) to "restore your account"
• The display of the following page, or ones similar to it, that asks you to fill out your PayPal account and bank details:

PWS:HTML/Phish.BE is a password-stealing malicious webpage, known as a phishing page, that disguises itself as a legitimate PayPal webpage.

PWS:HTML/Phish.BE  attempts to steal your banking and PayPal account information by tricking you into filling out your details in a form on a fake page, and then sending that information to a remote attacker.

It may use images, logos and layouts that the authors of PWS:HTML/Phish.BE have copied from an authentic PayPal site.

The phishing page is an HTML page that is usually hosted on compromised or malicious websites, which an attacker may attempt to lure you to by clicking a link in an email.

Alternatively, a visit to a compromised or malicious website can be used to redirect you to a website that hosts phishing pages that are then detected as PWS:HTML/Phish.BE.

In the wild, we have observed the following example webpage:

The information that PWS:HTML/Phish.BE attempts to gain from you includes the following:

• Full name
• Email address
• PayPal password
• SSN (social security number) if you reside in the US
• Credit/debit card number
• Credit card expiry date
• 3-digit card security code
• Bank name
• Date of birth
• Address
• Phone number

This information is sent to a website when the "Agree and Restore your account" button is pressed. We have observed the information being sent to the following websites:

• hxxp://debtmanagersoft.com
• hxxp://www.strmedia.com/reels/0000/0004/process.php
• hxxp://sochifito.cl/reactivation/w.php

Analysis by Rex Plantado

To detect and remove this threat and other malicious software that may be installed on your computer, run a full-system scan with an appropriate, up-to-date, security solution. The following Microsoft products detect and remove this threat:

• Microsoft Security Essentials
• Microsoft Safety Scanner

PWS:HTML/Phish.BE attempts to steal sensitive and confidential information from affected users to perpetrate fraud. If you believe that your personal financial information may have been compromised, please refer to the following advisory for additional advice:

• What to do if you are a victim of fraud