New DHL Phishing Scam Uses 11-Step Attack Chain to Steal Passwords
DHL phishing campaign uses 11-step attack chain with fake OTP and EmailJS to steal credentials.
Forcepoint X-Labs discovered a sophisticated phishing campaign impersonating DHL Express that employs an 11-step attack chain to harvest user credentials and device telemetry. The scam uses a spoofed email, fake OTP verification page, and EmailJS to exfiltrate stolen data while maintaining victim trust. The campaign targets individuals broadly with no geographic concentration and demonstrates how attackers leverage legitimate services to reduce infrastructure complexity.
AI summary of the linked source. Not reviewed by an editor. How this works
Run DHL?
Get an email when a new story names DHL, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
What helps against this
How we list vendors
- Email authentication (DMARC)
Nobody can send email that pretends to come from your domain.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — cupelva.com
- domain — perfectgoc.com
- email — notification@cupelva.com