In Q4 2021, DHL, Google, and Microsoft were the most imitated brands in phishing campaigns.
DHL, the international package delivery and express mail service, delivers over 1.6 billion parcels per year.
During the final quarter of every year which includes the Black Friday, Cyber Monday, and Christmas shopping seasons, phishing campaigns impersonating the delivery brand have higher chances of reaching victims. Cyber Monday and Black Friday are usually the busiest times for phishing.
Phishing is a form of deception that uses a person’s distress to trick them into providing sensitive information.
Fraudsters use such lures as packages that are stuck at customs and require action to get them cleared, and fake tracking numbers that they hide inside document attachments or embedded links.
According to a report by Check Point, the top ten brands impersonated by phishing actors in Q4 2021 were DHL (23% of all phishing attacks globally), Microsoft (20%), WhatsApp (11%), Google (10%), LinkedIn (8%), Amazon (4%), FedEx (3%), Roblox (3%), Paypal (2%), and Apple (2%).
An example of a phishing campaign in the Check Point’s report used spoofed email addresses to send a “shipment notification” message to a customer support email address. The email asked the recipient to verify their identity by clicking on a link to a phishing page that looks very similar to the real DHL site.
In another sample, the thieves claim that they cannot deliver the parcel. This phishing campaign asks the target to confirm their personal information and enter their details on a FedEx phishing site.
Yet another sample impersonating PayPal asks for personal information to lift a temporary suspension and deliver the parcel to the recipient.
The best way to avoid getting bogged down by fake emails that claim to be from a trusted organization is to be cautious and avoid immediately clicking on suspicious links.
Instead of clicking on the link in the email, open a new browser tab and verify the URL’s validity. While on the official website, log in to your account. If any action is required from you, you’ll see the corresponding notification.
Never click on embedded buttons and links in unsolicited communications that might open infected documents.
