It looks like a real PayPal feature they're abusing by inserting their phishing message into a generic message field. They're aiming to get you to call that number

No compromised cert needed