The holiday shopping season means big business for retailers around the world, but it unfortunately also means big business for hackers. The reasoning is, people tend to be on the lookout for various package delivery emails, lowering their guard when potential phishing emails arrive. Hackers know this and are already on the move with their holiday scams.
Package Delivery Scam
Louis Morton, a security professional based in Fort Worth, Texas, was sent a suspected Smishing message (SMS-based Phishing Attack) by his wife, indicating that a package couldn’t be delivered and action was needed for redelivery. Morton attempted to visit the domain in the phishing link, which looked something like the following (but isn’t exactly the same for safety reasons) 9991_c_fedeex[.]com from a desktop web browser, but found it redirects the visitor to a harmless page with ads for car insurance quotes. This is a typosquatted Fedex domain. But by loading it on a mobile device (or by mimicking one using developer tools), the browser directs them to, returns-fedex.com, shown below.
This attack followed an unusual setup by blocking non-mobile users from visiting the domain. This helps minimize inspection of the site from security researchers, potentially keeping the malicious site online longer.
After You Click The Link
Clicking “Schedule New Delivery” brings up a page that requests your name, address, phone number and date of birth. Those who click “Next Step” after providing that information are asked to add a payment card to cover the $2.20 “Redelivery Fee”. After clicking “Pay Now,” the user is prompted to verify their identity by providing their Social Security Number, driver’s license number, email address and email password. Scrolling down on the page revealed more than a half dozen working links to real fedex.com resources online, including the company’s security and privacy policies. After clicking “Verify,” the user is redirected to the real FedEx at Fedex.com.
Don’t Fall Victim
A hacker’s main weapon of choice is social engineering. Once you’re aware of this, you can confidently watch out for Phishing/Smishing Attacks, Impersonation Attacks, Romance Scams, and other various attacks all based upon social engineering. Being aware of specific holiday-based scams like this shipping delivery scam is essential to keeping you and your family secure.
Other Cybersecurity Best Practices
There are other actions you should take to protect your business from attacks including:
- Adopt a password manager for better personal/work password hygiene
- Require two-factor authentication on any SaaS solution and all critical accounts
- Require 14+ character Passwords in your Governance Policies
- Train employees to spot and avoid email-based phishing attacks
- Check that employees can spot and avoid phishing emails by testing them
- Backup data using the 3-2-1 method
- Incorporate the Principle of Least Privilege
- Perform a risk assessment every two to three years