Researchers at Avanan have spotted a new phishing campaign that’s impersonating DHL with phony shipping notifications. The emails inform the recipients that they need to update their delivery address in order to receive a package.
“In this attack, scammers are using brand impersonation,” the researchers write. “By showing a page that looks like it comes from a trusted brand, they’re hoping to trick end-users into clicking on a link. That link, however, is a classic credential harvesting link, looking to steal data and other information. The email starts with noting that there is an ‘undelivered’ package from DHL. By going online, you can submit your address, as well as other information, to get the delivery on time and at the right place. However, that won’t happen. “
The researchers note that impersonating DHL allows the attackers to target people all around the world, particularly during the holiday season.
“What’s particularly clever is the spoof of DHL,” Avanan says. “Not only is DHL the third-most impersonated brand, according to Check Point Research, but it also delivers packages from around the globe. With folks broadening their purchasing horizons this holiday season, a DHL package is more likely, making the spoof more believable. The hackers are utilizing the classic social engineering tactic of urgency to get end-users to click. The thinking, they hope, is that end-users will be in a panic seeing that their package won’t get to their door on time, and will enter their info without thinking.”
Avanan offers the following advice to help users recognize these attacks:
- “If clicking on the harvesting link, inspect the URL
- “Pay close attention to mistakes in the email. “DHL Office” is not a real place—the closet think would be DHL Express ServicePoint
- “Pay extra attention to emails from brands, especially around the holidays. Check Point Research has found that two of the top five most impersonated brands ship goods (DHL, Amazon)
- “Ensure that the package that has been ordered is actually shipping with DHL. The tracking number provided provided with the original order will show if the package is delivered with DHL and the true delivery status
- “Utilize an email security solution that relies on multiple factors to determine an email is phishing”
It’s a seasonal trend, but a perennial threat. New-school security awareness training can enable your employees to avoid falling for phishing attacks.
Avanan has the story.
Here's how it works:
