The 11-Step Trap: How a Fake DHL OTP Trick Steals Your Password

Forcepoint X‑Labs discovered a consumer-focused phishing campaign impersonating DHL that guides victims through a staged 11-step flow: a spoofed shipment email (with DKIM for the attacker domain), a locally generated “parcel-themed” OTP to build trust, and a pre-filled DHL-branded login page to harvest credentials and device telemetry. Stolen data is sent via EmailJS to an attacker mailbox and victims are redirected to the legitimate DHL site to avoid immediate detection.