'This campaign works because it feels ordinary': Experts reveal how hackers use fake DHL messages to lure in victims

Date:
Wed, 29 Apr 2026 17:35:00 +0000

Description:
Forcepoint uncovers new phishing campaign using DHL assets, and even found where the passwords are being sent to.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter A phishing campaign is spoofing DHL emails to steal login credentials Victims are tricked with a fake waybill confirmation and staged validation steps Captured data, including passwords and device details, is sent directly to attacker mailboxes Forcepoint has published a report about an ongoing phishing campaign designed to steal peoples DHL login credentials.

It starts by sending an email to the victim, asking for confirmation of a waybill. While the email itself looks authentic, and is designed in the same fashion legitimate DHL emails are, this one is easy to spot as fake - the domain being used to send the message is cupelva[.]com - completely unrelated to DHL. But many people dont double-check the senders address, so its safe to assume some might fall for the trick and click on the Confirm Waybill Information button included with the message. Article continues below You may like Hackers target LinkedIn accounts with devious new phishing attack
Experts reveal how hackers are trying to hijack your inbox with these clever tactics This devious VENOM phishing campaign targets business executives by name so watch what you click on Manipulating the perception When that happens, the victims are redirected to a malicious landing page where they
are first asked to type in the parcel code provided on the screen. Obviously, the entire thing is fake, and built only to get the victim to lower their guard and trust the process.

This page is designed to look like a shipment validation step. It is not a real OTP mechanism, Forcepoint said. This step serves no authentication function. It exists to manipulate the victim's perception of the workflow.

After typing in the numbers shown on the screen, the page waits for a few seconds, to get the victim to think that something is really being analyzed
in the backend. After that, the victim is redirected to a second page, where theyre asked to provide their login credentials.

This is where the theft happens, and if the victims do end up providing the password, it will be relayed, via email: Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me
with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

The kit initializes EmailJS and sends the captured data using the configured service and template. The attacker mailbox is slatty077@tutamail[.]com, Proofpoint added. Besides the email and the password , the campaign also captures the victims IP addresses, device details, and location data.

Phishing does not need technical sophistication to succeed, Proofpoint stressed. This campaign works because it feels ordinary. The DHL branding is familiar, the verification step looks legitimate, and the login form appears to confirm something the victim already started. None of it is real. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/this-campaign-works-because-it-feels-or dinary-experts-reveal-how-hackers-use-fake-dhl-messages-to-lure-in-victims


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)