New DHL Phishing Scam Uses 11-Step Attack Chain to Steal Passwords

Forcepoint X‑Labs discovered a phishing campaign impersonating DHL that lures victims with a spoofed waybill email, uses a fake OTP trick (locally generated six‑digit code) to build trust, then pre‑fills and captures credentials on a fake DHL login page. The kit also collects device telemetry and geolocation, exfiltrates the data via the EmailJS service to [email protected], and finally redirects victims to the real DHL site to avoid detection.