Some Phishers Who Know Their Trade

Researchers at Votiro have come across well-crafted phishing emails that purport to come from UPS, FedEx, and DHL. All of the emails contain malicious Excel attachments that will install ransomware on the victim’s computer. The spoofed emails appear to be sent from legitimate servers belonging to UPS, FedEx, and DHL, and they instruct the recipients to open the attachment to view an invoice. They use legitimate-looking branding and contain links to the companies’ real websites.

“The attacker wanted to make a phishing email appear as if it came from either FedEx, UPS, or DHL by injecting their servers into the header of the messages,” the researchers explain. “Even a well-trained person could be fooled by this phishing attack, as it makes the email sender appear to be legitimate.”

People should be suspicious of any unsolicited email that tells them to open an attachment, no matter how convincing it looks.

“People and businesses – even people who are aware of phishing emails – are susceptible to this email campaign,” the researchers state. “This email campaign was missed by SaaS email protection providers because the macro was both hidden and too novel to be included in existing signature databases. As of 2pm ET on May 5th, 2020, VirusTotal reports several email protection services that would still miss the UPS and FedEx email. This improves the chances that the attack makes it to business and personal inboxes. If an unsuspecting person received one of these legitimate-looking emails with a Microsoft Excel spreadsheet attached, it is highly likely that they would open the attached Excel spreadsheet and compromise their systems.”

Some phishing emails will always slip past technical defenses, and it only takes one slip to compromise your organization. New-school security awareness training can enable your employees to be on the lookout for malicious tactics in addition to visible signs of phishing emails.

Votiro has the story: https://votiro.com/anatomy-of-a-well-crafted-ups-fedex-and-dhl-phishing-email-during-covid-19/