Fake DHL Phishing Campaign Uses Client-Side OTP to Steal Credentials
Summary
Forcepoint X-Labs analyzed a DHL-themed phishing campaign that uses a locally generated fake OTP to build trust, then steals passwords and victim telemetry through a spoofed login page and exfiltrates the data via EmailJS.
Key points
- The campaign targets individual consumers and uses a spoofed DHL shipment email; the sender domain was cupelva[.]com, and the message likely passed DKIM for that domain rather than DHL.
- A fake parcel OTP page generates a six-digit code locally in JavaScript, with no server-side authentication or actual code delivery.
- The URL can carry the victim’s email address into a second-stage DHL-branded login page hosted at biotechgroup[.]net.
- The login page captures the victim’s password and collects IP address, device and browser details, approximate location, timestamp, page URL, and tracking number.
- The phishing kit uses EmailJS to send captured information to an attacker-controlled mailbox; the report identifies slatty077@tutamail[.]com.
- After submission, the page redirects victims to the legitimate DHL site, which the researchers say may reduce suspicion and delay reporting.
Article Details
- Attack Vectors
- A spoofed DHL shipment email directs recipients to a fake parcel OTP page.
- The OTP is generated locally in JavaScript and provides no real authentication.
- A DHL-branded login page collects the victim's password and gathers IP address, device, browser, location, timestamp, page URL, and tracking-number data.
- Captured credentials and telemetry are sent through EmailJS to an attacker-controlled mailbox.
- Defensive Notes
- The article reports blocking the lure email, categorizing the fake OTP and credential-harvesting URL domains, and blocking the attacker mailbox.
- Treat shipment-themed pages requesting account passwords as suspicious, and check whether the sender domain aligns with the brand being impersonated.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cupelva[.]com | Attacker-controlled envelope/from domain used for the spoofed DHL phishing email. |
info@cupelva[.]com | Spoofed sender address used for the DHL-themed phishing email. | |
slatty077@tutamail[.]com | Attacker-controlled mailbox configured to receive stolen credentials and victim telemetry. | |
| URL | hxxp[:]//biotechgroup[.]net/aaaavbvvb/newengDHL[.]html?email=victim@example[.]com | DHL-branded credential-harvesting URL that collects victims' passwords. |
| URL | hxxps[:]//perfectgoc[.]com/aacggh/OTPWITCALLER[.]html?email=[victim@example[.]com] | Fake parcel OTP phishing URL that leads victims into the credential-theft workflow. |
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe DHL-branded web page captures the victim's password through a login form.T1204.001 · Malicious LinkThe victim is induced to click the phishing link and proceed through the fake verification and login pages.T1566.002 · Spearphishing LinkThe campaign uses a spoofed shipment email containing a link to the fake OTP page.T1567 · Exfiltration Over Web ServiceThe kit sends stolen credentials and telemetry through the EmailJS web service to the attacker's mailbox.