A bait-and-switch scheme is targeting users of the financial service PayPal, according to security researchers.