PayPal phishing attack uses legitimate services to bypass Go