Comodo Antispam Labs has identified a new phishing scam targeting businesses and individuals who use DHL shipping. The fake emails are designed to effectively look like official DHL communications and ask recipients to check the tracking numbers for their impending shipments. If the user clicks on the link contained in the email, they are taken to a spoofed DHL web page which also appears to be official and prompts them to enter their username and password. If the victim enters their email and password, a new page opens with the text “Your email has been updated,” implying that the transaction was authentic when in fact the log in information has now been collected by cyber criminals. 

As the holiday season approaches, this new wave of phishing emails aims to exploit the increase in online shopping and deliveries. There are 2.5 million businesses and individuals worldwide who use DHL. The plausibility of a known vendor contacting these customers during the holiday season increases the likelihood that an unsuspecting victim will click this link and enter their information. 

As phishing scams evolve over time, the email subject and sender information will often change during such campaigns. This sample provided by Comodo lists the sender as DHL WORLDWIDE (dalida.elali@werrtonholdings.com.au) and the Subject as “DHL Shipment Delivery Tracking Number.” The body of the email states, 

Note that the fake link in the email is made to appear as the official DHL.com website but is simply an attempt to redirect users to the spoofed site. DHL is one of the world's largest shipping and logistics providers. As more people utilize online shopping and related services for their holiday purchases, the timelines of such phishing campaigns will reflect the habits of customers.