A new PayPal phishing attack has been confirmed with a critical twist: it’s phish-free. Here’s what you need to know.