Post-Black Friday Phishing Continues Targeting Postal Services

Black Friday and holiday sales periods continue to be a popular time for phishing scams, with a spike in mail delivery or redirection type scams in the months of November through December. Alpha Team has been tracking active phishing campaigns targeting mail delivery services and their customers. Common tactics include confirming a mail redirection request and demanding a fee to be paid before delivery can continue. It is likely that the uptick of these scams will continue through December due to the increased reliance on mail delivery during the holidays and the pandemic.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
Always verify the sender of suspicious or unexpected emails and messages
Never download attachments from unknown senders or suspicious emails
Never click on links or enter credentials when prompted unless you have checked the URL and purpose of the request is legitimate
Reach out to your ZeroFOX account manager or [email protected] if you need help setting up monitoring, configuration or want more information about the associated website

Details

Postal delivery services and couriers such as DHL, DPD and Royal Mail have seen a large spike in phishing campaigns targeting their brands over the month of November 2020. With an increase in people ordering online due to the pandemic, phishing attacks have been even more focused this year. Over the month of November, Alpha Team collected dozens of unique phishing kits and hundreds of URLs targeting these brands to analyse their contents and identify TTPs being used by threat actors performing this type of phishing scam.

Figure 1: Phishing page targeting DHL

E-mail remains the primary method of distributing phishing domains and luring victims, with senders consisting of a mix of commercial mailing list providers, compromised accounts and specially created email addresses from free mailbox providers. Phishing threat actors will often change the accounts display name to try and fool potential victims.

Figure 2: A compromised hotmail account sent mail as “DPD Local”

These types of phishing attacks will often pressure victims into clicking links and entering their bank details by informing them a package is unable to be delivered until they pay a fee, and their package will be returned unless they comply quickly.

Figure 3: DHL phishing page asking for a fee to be paid

Attackers are also using sophisticated techniques to ensure their phishing page is undetected for as long as possible. Alpha Team has observed multiple phishing campaigns using services such as Cloudflare and CAPTCHA forms, alongside PHP scripts designed to detect and block web crawlers.

Figure 4: Excerpt of “anti-bot” code designed to block specific IP ranges

With multi-factor authentication becoming more common, attackers are adapting their phishing kits and techniques to try and capture this information for fraudulent purposes.

Figure 5: Phishing page asking for SMS codes sent to the victims mobile

Attackers exfiltrate victim information using several different methods including the use of dropper e-mail addresses, log files and Telegram bots in order to provide redundancy, just in case their e-mail or website are banned before they collect victim data.

Figure 6: PHP function designed to save victim data to a local file and post to a Telegram channel

These types of phishing attacks are very common for the Black Friday and holiday season, continuing into the New Year sales season. Victims of these campaigns quickly fall victim to fraud as operators react swiftly to compromised details. With the added stress of a pandemic, fraudsters will likely continue to abuse mail courier companies to take advantage of the sense of urgency when delivering packages and goods.