Your DHL parcel as a door opener for fraud attempts: About crypto-stealers, keyloggers and document uploaders

How does the DHL malspam campaign work?

In the DHL malspam campaign, cybercriminals send messages to their victims by email or SMS informing them about a DHL parcel supposedly waiting at the post office or a failed delivery attempt. The message further states that quick action is required, otherwise no parcel delivery will be possible and the shipment will be returned to the sender. To prevent this, the message asks the recipient to provide information in a document to enable delivery. This document is either available as an attachment in the email or the SMS links to a website. Anyone who downloads and opens the file or visits the website behind the link downloads a crypto-stealer that installs itself on the system.

Why do so many consumers fall for fake DHL notifications?

There are two main reasons why many consumers fall for the cybercriminals' scam. The first is trust in a brand like DHL. This is also due to the fact that there are indeed genuine notifications from the logistics company via SMS or email. Since it is now part of everyday life for most people to receive a parcel via DHL, such messages are also not unusual. Even those who are not expecting a parcel may be curious and want to know what kind of parcel is supposedly waiting for them.

On the other hand, the cybercriminals in the DHL malspam campaign always pretend that quick action is required. For example, the messages indicate that the parcel will be returned to the sender in the next two days if there is no reaction. Some consumers allow themselves to be pressured by such a message and follow the instructions in the mail for fear of losing a parcel.

One trick of the criminals (which also gives an important clue that the message is fake) is that no consignment number is given with the messages. In this way, it is not possible for the recipient to trace which parcel it supposedly is. Tracking via the real DHL website is also not possible. This tempts the recipient of the message to follow the link in the mail or SMS. The fake DHL notifications also look deceptively real. The criminals use the original logo of the logistics company DHL in the mails. At first glance, the message thus appears authentic and trustworthy.

How can consumers recognise fake DHL notifications?

First and foremost, it is important that consumers are suspicious of any notification. For example, if you are not expecting a parcel, you will not receive an email from DHL. Unfortunately, many consumers act impulsively and curiosity prevails in such situations. That is why many recipients open messages from cybercriminals and want to find out what the mail or SMS is all about.

With e-mails, it is comparatively easy to check the origin. However, it is important to know how to check this. Most e-mail providers do not show a mail address as the sender in the overview, but a description. Cybercriminals like to use trustworthy descriptions in their e-mails, such as "DHL Service" or simply "DHL". However, this description is easy to edit and does not allow any conclusions to be drawn about the actual sender. However, if you move the mouse over the description, the actual sender is displayed. Then, the alleged DHL message is revealed to be a mail from a foreign address with no connection to DHL.

In the case of a text message, it is initially more difficult to get any clues about the sender. A sure sign of a fraud attempt, however, are telephone numbers from abroad. These can be identified by the area code. In addition, fake DHL notifications lack a reference to a specific parcel number. Instead, a link is placed in the message that leads the recipient to a dubious website. The fraudsters also like to use URL shortening services such as bit.ly to disguise the actual address. DHL does not use such services and always links directly to its own website.

What malware is hidden in the fake DHL notifications?

The cybercriminals have placed a crypto-stealer in the fake DHL notifications. This is no stranger to IT security experts and has the name "BluStealer". The crypto-stealer combines several functions and is therefore particularly dangerous. First, the malware steals contact addresses and telephone numbers from the address book of the infected system. The crypto-stealer automatically sends itself to these addresses and also uses the fake DHL notifications as message content.

The crypto-stealer is then able to steal login information from the infected systems. The malware then sends this to the cybercriminals, who thus take control of the so-called digital wallet. A digital wallet is the wallet of cryptocurrencies that various providers make available on the internet. It is confirmed that the crypto-stealer steals the login data of numerous wallet providers. Among others, ArmoryDB, Bytecoin, Jaxx Liberty, Exodus, Electrum, Atomic, Guarda or Coinomi are affected.

Likewise, the DHL malspam campaign is not limited to a specific cryptocurrency. The focus is, of course, on Bitcoin due to its high value. However, the crypto-stealer also has Ethereum, Monero and Litecoin in its sights.

A clever function of BluStealer is to replace crypto addresses in the clipboard with the address of the criminal's wallet. Those who initiate a payment with Bitcoin or another cryptocurrency usually use the copy function of the operating system to do so. This is due to the length and complexity of these addresses. Most such crypto addresses consist of 26 to 35 alphanumeric characters. From this typical length and composition, the crypto-stealer recognises that it is a crypto-address. Unless the user is then extremely vigilant and notices that the address has changed during copying, he initiates and confirms a crypto payment to the criminals. Such payments cannot be reversed with cryptocurrencies.

What is the scope of the DHL malspam campaign and who is affected?

Since the crypto-stealer has the ability to send itself, the spread of the malware is increasing rapidly. Thus, the cybercriminals are constantly gaining new telephone numbers and contact addresses. Particularly affected by the DHL Malspam campaign are the USA, Argentina and Turkey, as well as Italy, Greece, the UK and Spain in Europe. However, numerous consumers in Germany and France have also come forward and report receiving fake DHL notifications.