Sophos Cloud Optix
There is a significant wave of malicious emails being spammed out presently, posing as notification messages from DHL.
If you make the mistake of opening the attached ZIP file you will be putting your computer at risk of infection by a Trojan horse.
There’s nothing new, of course, about cybercriminals disguising their attacks as notifications from DHL.
This attack, though, is particularly aggressive and – as you can see in the examples below – uses a variety of different DHL-related subject lines, attachment names and message bodies:
HELLO!
Dear Client, Recipient's address is wrong
Print out the invoice copy attached and collect the package at our department
Best wishes , DHL Customer Services
ATTENTION!
DEAR CLIENT , We were not able to deliver the postal packagePlease print out the invoice copy attached and collect the package at our department
Pack it. Ship ip. No calculating, Your DHL .com Customer Services
Good afternoon!
DEAR CUSTOMER, Recipient's address is wrong
PLEASE PRINT OUT THE INVOICE COPY ATTACHED AND COLLECT THE PACKAGE AT OUR DEPARTMENTPack it. Ship ip. No calculating, Your DHL .com Customer Services
Good afternoon!
Dear User , Delivery Confirmation: FAILED
Please print out the invoice copy attached and collect the package at our department
With respect to you, DHL Team
Here are just some of the different disguises we saw in a snapshot of less than one minute in a small selection of our spam traps:
Sophos products intercept the attack, detecting the ZIP file as Troj/Invo-Zip and the Trojan horse contained within as Mac/EncPk-NS.
Dangerous emails claiming to come from courier companies are nothing new – it has become one of the most commonly-used methods by which hackers socially engineer unsuspecting users into opening a malicious attachment or clicking on a dangerous link.
Make sure that you and your friends are wise to the trick – and think before you click.
Who falls for this?!
If you just look at the email address it was sent from you know it is spam!
and my spam blocker picks them up every time.
You must be a mug to fall for these emails
High pressure business are not interested in a “from” address, Only the content of any email that may affect their business concerns,
This is the exact oversight the spammers are trying to exploit, and it does work.
The management lot that have no time to assess a from address. and think abaout it, why should they care?, they pay mega bucks to us IT lot to worry about that sort of thing.
I also got one the other day from the 'new york police department' about a parking ticket!
ive not been to new york, i like in the UK!
Did notice however that the Sophos Gateway appliance took a bit of time to get on top of these, when the first started appearing, 🙂 Just a friendly dig…. you guys do a top job – keep up the good work!!!
I think they are funny. DHL closed in my area 2 years ago and does not deliver at all here. Stupid idiots!!!!!
Look guys, neither the cyber-criminals, nor the victims are complete idiots. The criminals aren't idiots because they know that at least a few people will fall for the trick. The victims aren't idiots because some of them might actually be expecting a parcel from DHL. It just takes a moment's inattention or lack of vigilance, that's all.
This happened to me with a Fed Ex email. It stated our package would be delivered within 7 days, and to reply to the email for the details. I knew we were not expecting a package, so immediately deleted the email. Thanks to Sophos posts on FB, I have been made aware of the possible problems involved in such things.
I just want to point to the issue that usually spammers leave behind misspellings. And in exemple #2 and #3, we can see the Pack it. Ship ip instead of Pack it. Ship IT !