#threatreport #LowCompleteness
Inside a Fake DHL Campaign Built to Steal Credentials | 28-04-2026
Source:
forcepoint.com/blog/x-labs/f…
Key details below ↓
💀Threats:
Credential_harvesting_technique,
🎯Victims: Consumers, Individuals
🏭Industry: Logistic
📚TTPs:
⚔️Tactics: 3
🛠️Technics: 0
🤖LLM extracted TTPs:`
T1016.001, T1566.002, T1567, T1614
🧨IOCs:
- Domain: 1
- Url: 3
- Email: 2
📜Programming Languages: javascript
#threatreport:
A recent phishing campaign identified by X-Labs targets individuals, utilizing DHL's branding to deceive users and steal their credentials. The attack unfolds in two main phases: the initial lure and the exploitation of a fake one-time password (OTP) verification step, both designed to foster trust before executing the theft of sensitive information. The phishing email mimics a shipment notice from DHL, using the display name "DHL EXPRESS," although it originates from a fraudulent domain,
cupelva.com. While the message may pass DKIM checks, which can mislead filtering systems, it is ultimately malicious because it’s authenticated by a domain owned by the attackers.
The phishing kit, described as lightweight, follows an 11-step attack chain. After receiving the phishing email, victims are directed to a fake OTP page that generates a six-digit number through local JavaScript, contributing to the illusion of legitimacy. In this phase, the kit retrieves the victim's public IP address via various services, which helps the attacker identify high-value targets and differentiate genuine users from those represented by automated scanners. This data can also support further fraudulent activities.
To facilitate the credential harvesting, attackers exploit EmailJS, a legitimate service that allows for seamless data exfiltration through the browser without heavy infrastructure requirements. Through this tactic, the attackers can maintain a low profile and develop their phishing schemes more efficiently. Ultimately, while the campaign lacks sophisticated malware or complex backend systems, it relies on familiar elements to guide victims towards sharing their credentials without arousing suspicion.
The combination of a false verification process, the use of a legitimate third-party service for data collection, and the final redirect to the authentic DHL site are strategic moves meant to prevent immediate detection. This incident underscores that phishing attacks can be highly effective even without technical complexity, relying instead on psychological manipulation and trusted branding to achieve their objectives.