Phishing Campaign Impersonates DHL to Steal Credentials via Fake OTP Scheme Researchers at Forcepoint’s X-Labs uncovered a sophisticated phishing campaign leveraging the DHL brand to harvest login credentials through an 11-step attack chain. The operation begins with a spoofed email bearing the subject line “DHL EXPRESS WAYBILL CONFIRMATION REQUIRED,” falsely prompting recipients to verify a shipment. While the display name appears as DHL EXPRESS, the sender domain cupelva.com reveals the deception, though the email bypasses some security filters by passing DKIM authentication for the attacker’s domain. Victims who click the embedded link are directed to a fake parcel verification page hosted at perfectgoc.com, where a locally generated six-digit "OTP" is displayed via JavaScript. Unlike legitimate two-factor authentication, this step does not involve SMS or email delivery; instead, users are instructed to input the on-screen code, creating a false sense of security. A deliberate two-second delay mimics real processing, further enhancing the illusion. Forcepoint researchers emphasized that this tactic targeting individuals without geographic or organizational focus relies on psychological manipulation rather than technical complexity to lower victims’ defenses. The attack employs URL-based identity injection to pre-fill the victim’s email address on a counterfeit DHL login portal, increasing perceived legitimacy. Once credentials are entered, the phishing kit exfiltrates additional telemetry data, including the user’s public IP, device type, OS, browser version, and geolocation (city/country). This data is temporarily stored in the browser’s local storage before being transmitted. For data exfiltration, the attackers use EmailJS, a legitimate service that enables direct browser-to-email transfers, eliminating the need for dedicated command-and-control infrastructure. Stolen information is sent to the attacker-controlled mailbox [email protected]. Upon completion, victims are redirected to DHL’s authentic website, reducing suspicion by simulating a successful login. Forcepoint noted the campaign’s effectiveness stems from its focus on social engineering over malware, with mitigation requiring the blocking of weaponized URLs and monitoring of the attacker’s mailbox.

Russian Cybercriminal Group Exposes 74,000 Fortinet Firewall Credentials in Massive Leak A Russian-speaking cybercriminal group inadvertently exposed credentials from nearly 74,000 Fortinet firewalls and VPN gateways worldwide after leaving the data unsecured on a server. The breach, discovered by security researcher Volodymyr “Bob” Diachenko over the past weekend, was confirmed by other researchers, including Kevin Beaumont, who verified the authenticity of the leaked login details. The compromised data, dubbed FortiBleed, includes configuration files containing sensitive information visible only from the devices themselves. The group obtained the credentials through automated large-scale harvesting, intercepting SSL VPN authentication hashes, cracking them using a 45-GPU cluster via Hashtopolis, and leveraging the passwords to infiltrate Active Directory environments. Researchers at Hudson Rock identified 73,932 unique firewall URLs across 194 countries, with many devices exposing their FortiGate Management Interface to the internet. While Fortinet previously addressed password storage vulnerabilities in early 2025 by adopting PBKDF2 with randomized salt, many devices still use the older, weaker SHA-256 with salt method, making them susceptible to brute-force attacks. The leaked data appears to include both recently harvested credentials and older collections from prior breaches. The breach impacts high-profile organizations, including Samsung, Siemens, Foxconn, Oracle, Accenture, DHL, Infosys, and Fortinet, as well as government agencies and critical infrastructure sectors. Notably, four organizations spanning Japan, Taiwan/Vietnam, Iraq, and Turkey were fully compromised, with a Turkish NATO defense contractor suffering exfiltration of classified defense documents. Fortinet attributes the leak to exploited vulnerabilities and brute-force attacks, though the exact timeline of data collection remains unclear. Organizations using Fortinet devices are advised to assume compromise if their domains or IPs appear in the exposed dataset, requiring credential rotation, MFA enforcement, and system upgrades to mitigate further risks.