Inside a Fake DHL Campaign Built To Steal Credentials

Summary

A phishing campaign masquerading as DHL is designed to steal user credentials. The attack chain uses a fake one-time password page and a branded login portal, then exfiltrates the captured data through EmailJS. After the credentials are stolen, victims are redirected to the legitimate DHL website to reduce suspicion. The operation appears to target consumers worldwide while relying on relatively lightweight infrastructure.

Investigation

Forcepoint X-Labs examined the phishing email, the malicious links, and the JavaScript responsible for generating a client-side OTP. Their analysis showed that the phishing kit gathered device and geolocation details before transmitting the collected information to an attacker-controlled mailbox through EmailJS. Researchers were able to reproduce the full attack flow in a sandbox environment.

Mitigation

Organizations should block suspicious sender domains and watch for DKIM alignment mismatches that may indicate spoofing. Security teams should also filter or block URLs resolving to the identified malicious domains. Monitoring for unexpected EmailJS activity with unusual payloads can help surface credential theft attempts, while enforcing MFA on DHL-related accounts adds another layer of protection.

Response

Defenders should notify targeted users about the phishing campaign and require password resets for any compromised accounts. The malicious email should be quarantined, and the related domains should be blocked at the email and web gateway layers. Detection rules should also be updated to identify the observed URL patterns and the EmailJS-based exfiltration method.

## Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  The adversary, aiming to harvest DHL credentials, spoofs the cupelva.com domain (a known look‑alike) and crafts an email with the exact subject line used in recent campaigns. By sending this email through a compromised external SMTP server, the message reaches the Exchange inboxes, producing transport logs that match the rule’s criteria.

• Regression Test Script:

  
  # Simulated phishing email – should trigger the detection rule
  $smtpServer = "smtp.malicious-host.com"   # external compromised server
  $msg = @{
      From = "dhl@cupelva.com"
      To   = "victim@contoso.com"
      Subject = "DHL EXPRESS WAYBILL CONFIRMATION REQUIRED"
      Body = @"
  Dear Customer,

A waybill for your recent shipment requires confirmation. Please click the link below to verify your details:

https://malicious.example.com/verify

Regards, DHL Express “@ SmtpServer = $smtpServer } Send-MailMessage @msg

- **Cleanup Commands:**  

  ```powershell
  # Remove the test email from the victim's mailbox (Exchange PowerShell)
  Import-Module ExchangeOnlineManagement
  Connect-ExchangeOnline -UserPrincipalName admin@contoso.com
  Search-Mailbox -Identity "victim@contoso.com" -SearchQuery 'Subject:"DHL EXPRESS WAYBILL CONFIRMATION REQUIRED"' -DeleteContent
  Disconnect-ExchangeOnline -Confirm:$false

## Evasion Assessment & Hardening Recommendations

Recommendations

1. Broaden Sender Evaluation: Instead of a single hard‑coded domain, flag any email that fails SPF/DKIM alignment for the “dhl.com” brand and contains DHL‑related keywords.
2. Fuzzy Subject Matching: Replace exact string match with a regex that captures variations, case differences, and common obfuscations.
3. Enrich with URL Reputation: Parse message body for URLs; flag if any link resolves to a known malicious host or uses URL‑shorteners.
4. Add Attachment Heuristics: When the rule tags attack.t1192, incorporate checks for double‑extension files or scripts commonly used in DHL‑related phishing.

Implementing these hardening steps will raise the resilience score toward 4–5, reducing the risk of simple evasion while maintaining a low false‑positive rate.