I found out that this issue is only relevant when Malwarebytes Internet Protection is on. When it's off, PayPal gives the browser its real certificate. But it's still weird that with that thing enabled the certificate is coming from VMWare. Might be software conflict. I'm leaving this topic open until Malwarebytes support gives comments about it.
