Some Phishers Who Know Their Trade



iStock-1133604495 (1)Researchers at Votiro have come across well-crafted phishing emails that purport to come from UPS, FedEx, and DHL. All of the emails contain malicious Excel attachments that will install ransomware on the victim’s computer. The spoofed emails appear to be sent from legitimate servers belonging to UPS, FedEx, and DHL, and they instruct the recipients to open the attachment to view an invoice. They use legitimate-looking branding and contain links to the companies’ real websites.

“The attacker wanted to make a phishing email appear as if it came from either FedEx, UPS, or DHL by injecting their servers into the header of the messages,” the researchers explain. “Even a well-trained person could be fooled by this phishing attack, as it makes the email sender appear to be legitimate.”

People should be suspicious of any unsolicited email that tells them to open an attachment, no matter how convincing it looks.

“People and businesses – even people who are aware of phishing emails – are susceptible to this email campaign,” the researchers state. “This email campaign was missed by SaaS email protection providers because the macro was both hidden and too novel to be included in existing signature databases. As of 2pm ET on May 5th, 2020, VirusTotal reports several email protection services that would still miss the UPS and FedEx email. This improves the chances that the attack makes it to business and personal inboxes. If an unsuspecting person received one of these legitimate-looking emails with a Microsoft Excel spreadsheet attached, it is highly likely that they would open the attached Excel spreadsheet and compromise their systems.”

Some phishing emails will always slip past technical defenses, and it only takes one slip to compromise your organization. New-school security awareness training can enable your employees to be on the lookout for malicious tactics in addition to visible signs of phishing emails.

Votiro has the story: https://votiro.com/anatomy-of-a-well-crafted-ups-fedex-and-dhl-phishing-email-during-covid-19/


Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/phishing-security-test-offer



Subscribe to Our Blog


Comprehensive Anti-Phishing Guide




Get the latest about social engineering

Subscribe to CyberheistNews