Once you verify you didn't actually buy something from PayPal, you should have deleted and blocked the emailer and not clicked on the link or called them. Look at the email address they sent the attachment from. It most assuredly wasn't from PayPal, which is your first clue they want to scam you. Unfortunately, they now know you're a real person and will be sharing your contact with all their other scam partners. As long as you didn't give them any information, you're safe. But don't ever open an attachment unless you know its from the real PayPal or any other business you have an account with. Always check the email address something is from.
Read this about avoiding Phishing Scams --> Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support