In this attack, attackers impersonate a USPS package tracking page to steal credit card credentials.
Platform: Office 365
Mailboxes: 15,000 – 50,000
Bypassed Email Security: IronPoint
Payload: Malicious Link
Setup: With holiday delivery deadlines quickly approaching and online orders continuing to pour in, courier services are facing increasing pressure from anxious consumers. This rise in shipping demand has made Amazon, USPS, UPS, and Fedex targets of increasing impersonation attacks aimed at their unsuspecting customers.
Email attack: This attack mimics a delivery notification email from the U.S. Postal Service, notifying the recipient that their package cannot be delivered until their payment is confirmed. Although the email appears to originate from “USPS” and features the official USPS logo, the true sender is email@example.com. The email prompts the recipient to confirm their package by clicking on a link which leads the recipient to a fake USPS tracking site claiming additional shipping fees must be paid to ensure package delivery. This page asks for payment details to fulfill this charge, setting a trap for the recipient to release sensitive credit card information to the scammers.
Payload: The malicious link hidden under the “Confirm My Package” hypertext redirects to https://www[.]kingstark[.]net/PackageBill/cvea1, a phishing site posing as a tracking page for USPS packages. The landing page contains a fake tracking number for the recipient’s supposed package, and prompts them to enter their credit card information. If submitted, these payment credentials are sent directly to the attackers in a successful payment fraud scheme.
Result: Should recipients fall for this attack, scammers can use their credit card information to make unauthorized transactions.
Urgency: The email states that payment confirmation must be made within 3 days, or else it will expire and their package will not be delivered. Additionally, this attack was timed strategically before the holidays, motivating the recipient to act quickly so they receive their important packages in time.
Timing: This email has taken advantage of the influx of e-commerce over the holiday season. With consumers expecting several packages and receiving many similar delivery notification emails, the scammers hope that they will be less likely to examine this fraudulent email and more likely to fall victim to their attack.
Trend: Many shipping companies have reported an increase in email impersonation scams characterized by these fake delivery notifications. According to data from Check Point Software Technologies, November saw a 440% increase globally in shipping phishing emails compared to October. We expect this trend to continue to spike even more in December and throughout the duration of the holiday season.
Abnormal is the email security company that stands for trust.
© 2020 Abnormal Security Corporation.
All rights reserved.