Increasingly, customers of well-known corporations and organizations are falling prey to cybercriminals’ ever-evolving and increasingly sophisticated tactics. Recently, Comodo Threat Research Labs detected that DHL customers are being targeted in order to steal their credentials. The unique aspect of this particular crime is that a government website is being hacked to host the malicious URL. This URL then redirects customers to the actual phishing website that’s imitating the DHL site.
“It’s a clear example of how compromised government assets may be utilized in phishing attacks targeting citizens. No organization or company is secure enough, unless the necessary measures are taken. Government assets are no exception,” said Fatih Orhan, Director of the Comodo Threat Research Labs.
Specifically, in this latest campaign, a bogus email mimics a DHL shipment notification alerting the customer to fill in the required information in order to take delivery of a parcel. However, the link provided within the email does not redirect to an official DHL website, but instead to a compromised domain of the South Africa Accreditation Authority, a government entity. The target URL is http://www.saaa.gov.za/cache/screenid.php, and when the user clicks this link, they are redirected automatically to the actual phishing site, http://realestateinsarasotabradenton.com/solid/logon.html. This site is not related to DHL but is an exact copy of an official DHL website.
Meanwhile, unsuspecting DHL customers have no reason to believe that they have been led astray and may end up complying with payment requests, and ultimately ending up with a system-wide infection.
A statement on the DHL website reads: “Attempts have been made to defraud Internet shoppers by the unauthorized use of the DHL name and brand via email communications and graphics which appear, on the surface, to have originated from DHL. In most cases the communications concern the sale of consumer goods over the Internet where payment may be requested before the goods are delivered. Please be advised that DHL does not request payment in this manner. DHL only collects money due for official DHL related shipping expenses.”
There is increasingly a need for a new and more vigilant approach to tackling these threats, Orhan said, and the key is prevention, rather than trying to fix, or at least remediate the damage from the problem once it has already occurred.
About the Comodo Threat Research Labs
The Comodo Threat Research Labs is made up of more than 40 IT security professionals, ethical hackers, computer scientists and engineers, all full-time Comodo employees, analyzing and filtering spam, phishing and malware from across the globe. With offices in the U.S., Turkey, Ukraine, the Philippines and India, the CTRL team analyzes more than 10 million potential pieces of phishing, spam or other malicious/unwanted emails per day, using their insights and findings to secure and protect Comodo’s current individual, small and medium business and enterprise customer bases, the public at large and the Internet community.
