USPS Impersonated in Credit Card Phishing Scam

December 23, 2020

With holiday delivery deadlines quickly approaching and online orders continuing to pour in, courier services are facing increasing pressure from anxious consumers. This rise in shipping demand has made Amazon, USPS, UPS, and FedEx targets of increasing impersonation attacks aimed at their unsuspecting customers. In this attack, attackers impersonate a USPS package tracking page to steal credit card credentials.

Summary of Attack Target

Platform: Office 365
Bypassed Email Security: IronPoint
Victims: Employees
Payload: Malicious Link
Technique: Impersonation

Overview of the Credit Card Phishing Attack

This attack mimics a delivery notification email from the U.S. Postal Service, notifying the recipient that their package cannot be delivered until their payment is confirmed. Although the email appears to originate from “USPS” and features the official USPS logo, the true sender is support@xmtservices.com.

The email prompts the recipient to confirm their package by clicking on a link, which leads the recipient to a fake USPS tracking site that claims that additional shipping fees must be paid to ensure package delivery. This page asks for payment details to fulfill this charge, setting a trap for the recipient to release sensitive credit card information to the scammers.

In an ironic twist, the email includes a banner that reads "***This email is from an external source. Only open links and attachments from a Trusted Sender.***," showcasing how far attackers will go to trick unsuspecting victims.

The malicious link hidden under the “Confirm My Package” hypertext redirects to https://www[.]kingstark[.]net/PackageBill/cvea1, a phishing site posing as a tracking page for USPS packages. The landing page contains a fake tracking number for the recipient's supposed package, and prompts them to enter their credit card information. If submitted, these payment credentials are sent directly to the attackers in a successful payment fraud scheme.

Should recipients fall for this attack, scammers can use their credit card information to make unauthorized transactions.

Why the Credit Card Phishing Attack is Effective

This attack creates legitimacy through the use of USPS logos in both the email and landing page. The landing page, in addition to a section for payment details, includes a fake tracking number, links that lead to actual USPS webpages, and even a checkbox for the recipient to indicate that they have accepted the USPS Privacy Policy. These details contribute to the authenticity of this scam, thus increasing the likelihood that a recipient will overlook the suspicious link and fall into the trap.

In addition, the email includes a sense of urgency and states that payment confirmation must be made within three days, or else it will expire and their package will not be delivered. Timed strategically before the holidays, the point is to motivate the recipient to act quickly so they receive their important packages in time. It also aligns to a time when consumers are expecting an increase in packages and are receiving delivery notification emails.

Abnormal stopped this email due to the unusual sender, suspicious link, and the fact that the email failed authentication—a clear indicator that the email is malicious. In addition, the fact that this email includes a financial request but USPS typically does not send financial requests indicates that this email may be fraudulent.

Shipping companies worldwide have reported an increase in email impersonation scams characterized by these fake delivery notifications. According to data from Check Point Software Technologies, November saw a 440% increase globally in shipping phishing emails compared to October. We expect this trend to continue to spike even more in December and throughout the duration of the holiday season.

Want to protect your employees from holiday-related phishing scams? Request a demo now to see how.

Previous
Blog black lights
Because they contain the keys to the financial kingdom and allow attackers direct access to money, banks tend to be some of the most impersonated organizations. In this attack, attackers mimic an automated notification from BB&T in order to steal recipients' online banking...
Read More
Next
Blog bitcoin ledger
Cybercriminals are desperate to obtain recovery phrases of cryptocurrency wallet users, as those phrases allow them to gain access to peoples' sensitive information and crypto assets. In this attack, malicious actors impersonate Ledger—a hardware wallet...
Read More

Related Posts

B 10 15 21
With Detection 360, submission to threat containment just got 94% faster, making it incredibly easy for customers to submit false positives or missed attacks, and get real-time updates from Abnormal on investigation, conclusion, and remediation.
Read More
Extortion blog cover
Unfortunately, physically threatening extortion attempts sent via email continue to impact companies and public institutions when received—disrupting business, intimidating employees, and occasioning costly responses from public safety.
Read More
Blog engineering cybersecurity careers
Cybersecurity Careers Awareness Week is a great opportunity to explore key careers in information security, particularly as there are an estimated 3.1 million unfilled cybersecurity jobs. This disparity means that cybercriminals are taking advantage of the situation, sending more targeted attacks and seeing greater success each year.
Read More
Blog hiring cybersecurity leaders
As with every equation, there are always two sides and while it can be easy to blame users when they fall victim to scams and attacks, we also need to examine how we build and staff security teams.
Read More
Cover automated ato
With an increase in threat actor attention toward compromising accounts, Abnormal is focused on protecting our customers from this potentially high-profile threat. We are pleased to announce that our new Automated Account Takeover (ATO) Remediation functionality is available.
Read More
Email spoofing cover
Email spoofing is a common form of phishing attack designed to make the recipient believe that the message originates from a trusted source. A spoofed email is more than just a nuisance—it’s a malicious communication that poses a significant security threat.
Read More
Cover cybersecurity month kickoff
It’s time to turn the page on the calendar, and we are finally in October—the one month of the year when the spooky becomes reality. October is a unique juncture in the year as most companies are making the mad dash to year-end...
Read More
Ices announcement cover
Abnormal ICES offers all-in-one email security, delivering a precise approach to combat the full spectrum of email-borne threats. Powered by behavioral AI technology and deeply integrated with Microsoft 365...
Read More
Account takeover cover
Account takeovers are one of the biggest threats facing organizations of all sizes. They happen when cybercriminals gain legitimate login credentials and then use those credentials to send more attacks, acting like the person...
Read More
Blog podcast green cover
Many companies aspire to be customer-centric, but few find a way to operationalize customer-centricity into their team’s culture. As a 3x SaaS startup founder, most recently at Orum, and a veteran of Facebook and Palantir, Ayush Sood...
Read More
Blog attack atlassian cover
Credential phishing links are most commonly sent by email, and they typically lead to a website that is designed to look like common applications—most notably Microsoft Office 365, Google, Amazon, or other well-known...
Read More
Blog podcast purple cover
Working at hyper-growth startups usually means that unreasonable expectations will be thrust on individuals and teams. Demanding timelines, goals, and expectations can lead to high pressure, stress, accountability, and ultimately, extraordinary growth and achievements.
Read More