Got an email from Australia Post titled “Ábout your parcel”? Take care, it’s likely to be the latest email scam, designed to steal users’ confidential data.
This new phishing scam, now being intercepted by MailGuard, claims that “your shipment is still pending instructions from you.” It requests the user to “Çlick here’’ to “Çonfirm the payment of the home delivery costs ($1.65 AUD) and the shipment of the package”
The suspicious looking email, from AU.Postal and sent from apache(at)orangemoto(dot)com tries to entice users to enter personal details via a red call to action button ‘’Click Here’’.
Here’s what the email looks like:
When a customer clicks the red button, they are taken to an authentic looking Australia Post page (pictured below), that requests users to enter their personal details including name, phone number and address. The Australia Post branded phishing page is hosted at Theolevistre(dot)space.
Following this, users are taken to a page requesting their credit card details.
Once these credentials are entered and submitted, the attacker harvests them for later use, and the user is met with a verification page, with the message “redirecting the request to the processing centre page”.
Finally, users are taken to an SMS verification page. The page asks for a ‘SMS code’ which has been sent to the mobile phone number provided, mimicking an authentic OTP security process. This technique is often used by cybercriminals to feign authenticity.
Scammers then attempt to charge the credit card with the details supplied and redirect to the legitimate Australia Post website.
Big brands like Australia Post are attractive targets for cybercriminals, due to their trusted brand and enormous customer base.
MailGuard advises all recipients of this email to delete it immediately without clicking on any links. Providing your personal details can result in your sensitive information being used for criminal activity and may have a severe negative impact on your business and its’ financial well-being.
MailGuard urges users not to click links or open attachments within emails that:
- Are not addressed to you by name.
- Appear to be from a legitimate company but use poor English or omits personal details that a legitimate sender would include.
- Are from businesses that you were not expecting to hear from, and/or
- Take you to a landing page or website that is not the legitimate URL of the company the email is purporting to be sent from.
One email is all that it takes
All that it takes to devastate your business is a cleverly worded email message that can steal sensitive user credentials or disrupt your business operations. If scammers can trick one person in your company into clicking on a malicious link or attachment, they can gain access to your data or inflict damage on your business.
For a few dollars per staff member per month, you can protect your business with MailGuard's predictive and advanced email security. Talk to a solution consultant at MailGuard today about securing your company's inboxes.
Stay up-to-date with MailGuard's latest blog posts by subscribing to free updates. Subscribe to weekly updates by clicking on the button below.
