The Amazing Thing Is That DHL Phishing Campaigns STILL Work

Article Provided by Stu Sjouwerman of KnowBe4

Authored by: Stu Sjouwerman of KnowBe4

Researchers at Armorblox warn that a phishing campaign is impersonating DHL with fake shipping invoices.

“The subject of this email aimed to instill an automatic level of trust through the inclusion of the well-known and trusted brand name, DHL, reading: ‘DHL Shipping Document/Invoice Receipt,’” the researchers write. “The inclusion of a legitimate brand name within the email subject encourages victims to open the email in a timely fashion, assuming the email is a legitimate communication from the brand that needs attention. At first glance, the email seems to be a legitimate communication from international shipping company, DHL, with the sender name and email address reading DHL and dhl@vaimti-yacht[.]com respectively.”

The emails look like legitimate DHL notifications, and they were able to bypass security filters.

“The body of the email continues to impersonate the well-known brand, through the inclusion of the company logo and brand colors and signature pertaining to the DLP customer service department,” Armorblox says. “The email looks like a notification from DHL, notifying recipients about a parcel sent by a customer that needed to be rerouted to the correct delivery address. The body of the email has one simple call to action for the recipient, to view the attached document and confirm the destination address of the parcel shipment.”

The emails instructed users to open the Excel attachment, which asked them to enter their Microsoft account credentials in order to view the phony invoice.

“The goal of the targeted attack was for victims to follow the prompted instructions within the email body and open the attachment,” the researchers write. “The attachment included within this email attack was named Shipping Document Invoice Receipt to further instill trust in the unsuspecting victims that the attachment was a legitimate file from DHL and the “copy of DHL receipt for tracking”, as referenced in the body of the email. The information and language used within the email led victims to click the attachment, unsuspecting that the attachment had malicious intent.”

To see this article and to learn more visit: https://blog.knowbe4.com/the-amazing-thing-is-that-dhl-phishing-campaigns-still-work