The campaign initiates with spoofed DHL shipment notification emails that lure victims into a multi-step phishing process. Victims encounter a client-side generated fake OTP verification page designed to create false trust. Subsequently, they are directed to a credential harvesting portal mimicking DHL's branding. The phishing kit captures not only passwords but also extensive telemetry data including IP addresses, device details, browser fingerprints, and geolocation. Exfiltration of harvested credentials is performed using EmailJS, a legitimate client-side email service, sending data to an attacker-controlled Tutamail address. The campaign ends by redirecting victims to the official DHL website, minimizing suspicion and increasing the likelihood of successful credential theft. This attack exploits social engineering and brand trust rather than technical vulnerabilities.

Victims of this campaign risk having their DHL credentials and associated telemetry data stolen, which can lead to unauthorized access to their DHL accounts or reuse of credentials on other services. The collection of detailed telemetry data increases the potential for targeted follow-up attacks or identity theft. The campaign's use of legitimate services for exfiltration and redirection to the real DHL site reduces detection likelihood, increasing the success rate of credential theft. There are no known technical exploits involved, and no direct compromise of DHL systems is indicated.

There is no patch or technical fix for this social engineering campaign. Users should be educated to recognize phishing emails, especially those impersonating DHL with unexpected shipment notifications and OTP requests. Organizations should warn customers about this specific campaign and advise verifying URLs and email senders carefully. Blocking or monitoring the identified malicious domains (perfectgoc.com, biotechgroup.net) and URLs can help reduce exposure. Since this is a phishing campaign, standard phishing awareness and email filtering controls are recommended. No vendor patch or official fix is applicable.