I can’t say that I didn’t recently have a situation involving ScreenConnect-type malware and PayPal similar to what a certain Bob who contacted Steve Gibson had. Below is stuff that the Bob in question said:
Recently, I experienced a type of cyber attack I had not heard of. I can go into more detail, but basically, a program, ScreenConnect, was remotely installed on my PC and launched with no interaction by the client (me).
I became aware of the attack when I was at my mom’s house, and my phone started notifying me of money transfers that I did not initiate. I freaked out, as you might imagine. I rushed home, and when I got there, I found that my machine had been hijacked. My screens were blacked out with ‘ScreenConnect’ in large white letters. I was unable to do anything other than shutting down the machine.
Needless to say, I’ve been dealing with the aftermath, and fortunately I’m not out too much money. But I found out who my friends and foes are in terms of how they did or did not help me cancel the transactions. In short, PayPal’s response was abominable.
In my situation, some douchebag(s) at least tried to steal money from me using my PayPal account on at least three occasions recently. After discovering the first instance, I put a stop payment for a certain amount on my Wells Fargo checking account. By the time I discovered the second instance, however, I had a negative PayPal balance, plus a certain credit card of mine had been compromised. (Yes, the credit card in question has been reissued.) PayPal initially rejected my claims of theft, but they caved in after my father gave them a piece of his mind via telephone. I managed to catch the third instance as it was happening. I discovered the ScreenConnect-type malware on my desktop PC and removed it. I’ve also changed a certain setting in my password manager. For the record, my PayPal balance is no longer negative.