Phishing campaigns continue to evolve, not necessarily through technical complexity, but through psychological precision. A recently identified campaign targeting DHL customers demonstrates how attackers can combine brand impersonation, fake verification mechanisms, and lightweight infrastructure to steal user credentials at scale. This campaign does not target specific organizations or regions. Instead, it casts a wide net, aiming at everyday users by mimicking a familiar logistics workflow. What makes this attack particularly notable is its use of a fake One-Time Password (OTP) step—an illusion of security designed to build trust before executing credential theft.
Overview of the Attack Chain
The phishing kit operates through a structured yet simple 11-step attack flow:
- Email lure
- DHL brand impersonation
- Fake OTP verification page
- Client-side OTP generation
- Fake validation step
- URL-based identity injection
- DHL-themed login page
- Credential harvesting
- Victim profiling and telemetry collection
- Data exfiltration via EmailJS
- Redirect to the legitimate DHL website
Despite its simplicity, this chain is highly effective because it mirrors legitimate user experiences.
Stage 1: The Phishing Email
The attack begins with a spoofed email disguised as a DHL shipment notification. The message appears to request confirmation of a waybill or delivery details—something many users encounter regularly.
However, closer inspection reveals a mismatch: while the display name reads “DHL EXPRESS,” the sender domain originates from an unrelated source (e.g., cupelva[.]com). This discrepancy is a key indicator of phishing.
Interestingly, the email may pass DKIM authentication—but only for the attacker-controlled domain, not DHL. This highlights a critical nuance: authentication does not equal legitimacy.
Stage 2: Fake OTP Page and Trust Engineering
Clicking the email link redirects the victim to a parcel-themed OTP page. At first glance, it appears to be a standard verification step. In reality, the OTP is generated entirely on the client side using JavaScript.
There is no backend validation, no SMS delivery, and no actual authentication. The user is simply asked to re-enter a number already displayed on the screen.
Why This Works
The fake OTP step is not about security—it is about psychology:
- Creates perceived legitimacy: Users associate OTPs with secure systems
- Builds trust: Completing a “verification” step lowers suspicion
- Enhances realism: Multi-step workflows feel more authentic
Additionally, a deliberate delay of a few seconds simulates backend processing, reinforcing the illusion of a functioning system.
URL-Based Identity Manipulation
The phishing kit extracts the victim’s email from the URL (either query parameters or hash fragments) and carries it across pages.
This allows attackers to:
- Pre-fill login forms
- Personalize the interface
- Avoid asking for the email again
The result is a seamless, believable experience where the system appears to “recognize” the user.
Stage 3: Credential Harvesting Page
After the OTP step, victims are redirected to a DHL-branded login page. The interface is carefully designed to resemble a continuation of the shipment process.
Notably, the only input required is the password.
This is a major red flag—legitimate shipment verification workflows do not require account passwords. This confirms the true intent: credential theft.
Advanced Data Collection and Profiling
Before transmitting the stolen credentials, the phishing kit collects additional data to enrich the attack:
- Public IP address
- Device type and operating system
- Browser information
- Approximate geolocation
- Timestamp and page URL
This telemetry enables attackers to:
- Identify high-value targets
- Filter out bots or security scanners
- Support follow-up attacks such as account takeover
The data is also temporarily stored in the browser’s local storage—another indicator of malicious behavior.
Stage 4: Exfiltration via EmailJS
One of the most interesting aspects of this campaign is its use of EmailJS, a legitimate client-side email service.
Instead of maintaining their own infrastructure, attackers use EmailJS to send stolen data directly to their mailbox. This approach offers several advantages:
- Reduces operational overhead
- Avoids server-side detection
- Enables fully client-side execution
The stolen credentials and telemetry are packaged and sent to an attacker-controlled email address.
Stage 5: Redirect to Legitimate DHL Website
After submission, victims are redirected to the official DHL website.
This step serves a critical purpose:
- Reinforces the illusion that the process was legitimate
- Reduces immediate suspicion
- Decreases the likelihood of reporting
By the time the victim reaches the real site, the attack is already complete.
Key Takeaways
This campaign demonstrates that phishing success does not depend on technical sophistication. Instead, it relies on:
- Familiar branding
- Realistic workflows
- Psychological manipulation
The fake OTP step builds trust. The login page exploits it. Every component—from URL manipulation to EmailJS exfiltration—works together to maintain user confidence until the moment credentials are stolen.
Indicators of Compromise (IOCs)
- Subject: DHL EXPRESS WAYBILL CONFIRMATION REQUIRED
- Sender: info@cupelva[.]com
- OTP Page: perfectgoc[.]com/…
- Credential Page: biotechgroup[.]net/…
- Attacker Email: slatty077@tutamail[.]com
Our Opinion on This Campaign
This phishing campaign is a strong reminder that modern cyber threats are increasingly driven by behavioral design rather than technical innovation. The attackers did not rely on malware, zero-day exploits, or complex infrastructure. Instead, they focused on replicating a believable user journey. The inclusion of a fake OTP step is particularly noteworthy. OTPs are widely trusted by users as a security measure, and leveraging that trust—even in a completely fabricated form—demonstrates a deep understanding of user psychology. This shift toward “experience-based phishing” is more dangerous than traditional methods because it blends seamlessly into expected workflows.
Another important observation is the abuse of legitimate services like EmailJS. This tactic lowers the barrier to entry for attackers and makes detection more difficult, as the traffic does not immediately appear suspicious. From a defensive standpoint, this case highlights the need for better user education around process anomalies—not just technical indicators. Users should question why a shipment page asks for a password, regardless of how authentic it looks. Ultimately, this campaign reinforces a critical truth: trust is now the primary attack surface. Organizations must design both technical defenses and user awareness strategies accordingly.
