[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjjmHVkO97cKLQa7-E4ecfiplOBA1VyVfAzmBRMTO31k":3},{"article":4,"iocs":39,"watch_terms":51,"solutions":52,"lesson":30},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"666fcc6d-ce03-49a2-ba6d-43a03ab2511b","New DHL Phishing Scam Uses 11-Step Attack Chain to Steal Passwords","new-dhl-phishing-scam-uses-11-step-attack-chain-to-steal-passwords-f6ad2c","Forcepoint’s X-Labs reports an 11-step DHL phishing scam that uses fake OTP codes and EmailJS to harvest user credentials and device telemetry.","Forcepoint X-Labs discovered a sophisticated phishing campaign impersonating DHL Express that employs an 11-step attack chain to harvest user credentials and device telemetry. The scam uses a spoofed email, fake OTP verification page, and EmailJS to exfiltrate stolen data while maintaining victim trust. The campaign targets individuals broadly with no geographic concentration and demonstrates how attackers leverage legitimate services to reduce infrastructure complexity.","DHL phishing campaign uses 11-step attack chain with fake OTP and EmailJS to steal credentials.","https:\u002F\u002Fhackread.com\u002Fdhl-phishing-scam-attack-chain-steal-passwords\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F04\u002FNew-DHL-Phishing-Scam-Steal-Passwords.jpg","2026-04-28T21:33:11+00:00","2026-04-28T22:00:24.127653+00:00",8,[17,20,22,25],{"name":18,"type":19},"DHL","vendor",{"name":21,"type":19},"Forcepoint",{"name":23,"type":24},"EmailJS","technology",{"name":26,"type":27},"DHL Phishing Campaign","campaign","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[40,44,47],{"type":41,"value":42,"context":43},"domain","cupelva.com","Sender domain spoofing DHL Express in phishing email",{"type":41,"value":45,"context":46},"perfectgoc.com","Fake parcel OTP verification page hosting malicious phishing kit",{"type":48,"value":49,"context":50},"email","notification@cupelva.com","Attacker mailbox receiving exfiltrated credentials and device telemetry via EmailJS",[18,21],{"controls":53,"vendors":135},[54,81,110],{"slug":55,"name":56,"problem":57,"products":58},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"red-sift","Red Sift","\u002Fvendor-logos\u002Fred-sift.png","ondmarc","Red Sift OnDMARC","https:\u002F\u002Fredsift.com\u002Fpulse-platform\u002Fondmarc","Guided DMARC deployment and monitoring, with support for BIMI and MTA-STS.",{"vendor_slug":76,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":76,"url":79,"description":80},"dmarcian","\u002Fvendor-logos\u002Fdmarcian.png","dmarcian-platform","https:\u002F\u002Fdmarcian.com\u002F","DMARC report processing and guidance for moving domains to enforcement.",{"slug":82,"name":83,"problem":84,"products":85},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"slug":111,"name":112,"problem":113,"products":114},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[115,121,128],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":116,"product_name":117,"url":119,"description":120},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":111,"product_name":125,"url":126,"description":127},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":129,"product_name":132,"url":133,"description":134},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[136],{"slug":137,"name":21,"logo_path":138,"roles":139},"forcepoint","\u002Fvendor-logos\u002Fforcepoint.png",[140],"reported_by"]