Phishing websites now use chatbots to steal your credentials

Phishing attacks are now using automated chatbots to guide visitors through the process of handing over their login credentials to threat actors.

This approach automates the process for the attackers and gives a sense of legitimacy to the visitors of the malicious sites, as chatbots are commonly found on websites for legitimate brands.

This new development in phishing attacks was discovered by researchers at Trustwave, who shared the report with Bleeping Computer before publication.

Starts with an email

The phishing process begins with an email claiming to contain information about the delivery of a parcel, masquerading as the DHL shipping brand.

Phishing email sample (Trustwave)

Clicking on the button loads a PDF file that contains links to the phishing site. The threat actors display the phishing links in the PDF document to bypass email security software.

Downloadable PDF containing the malicious links
(Trustwave)

However, the URL button (or the link) in the PDF takes the victim to a phishing site (dhiparcel-management[.]support-livechat[.]24mhd[.]com) where they are supposed to resolve issues causing a package to be undeliverable.

This is where the chatbot takes over.

A chatbot steals your credentials

When the phishing page loads, visitors are greeted with a webchat explaining why the package could not be delivered instead of being shown a fake login form commonly used to steal credentials.

This webchat explains that the package's label was damaged, preventing its delivery. The webchat also displays a photo of the alleged package to add more legitimacy to the scam.

Chatbot on the phishing site (Trustwave)

The virtual assistant offers pre-defined responses for the visitor, so the conversation is fixed, always leading to showing a photograph of the alleged package featuring a damaged label.

Due to this problem, the chatbot requests the victim to give away details such as home or business address, full name, phone number, etc.

After that, the delivery is supposedly scheduled, and a bogus CAPTCHA step is added to act as one more false legitimacy creation mechanism.

Next, the victim is redirected to a phishing page that requires entering DHL account credentials and finally, leads to a payment step, supposedly to cover the shipping costs.

The final "Secure Pay" page contains the typical credit card payment fields, including cardholder name, card number, expiration date, and the CVV code.

Credit card payment field (Trustwave)

When the details are entered and the "Pay Now" button is clicked, the victim receives a one-time password (OTP) on the provided mobile phone number via SMS, which is again to add a sense of legitimacy.

One-time password verification screen (Trustwave)

Trustwave's analysts tested entering random characters, and the system returned an error about an invalid security code, so the implementation of the OTP verification is real.

If the correct code is entered, the fake page serves a "Thank you!" message and confirms that the submission has been received.

Campaigns getting more "genuine"

Perpetrators increasingly use mechanisms that are generally found in real websites, like CAPTCHAs, OTPs, and now even chatbots, making it harder for victims to realize the fraud.

This calls for greater vigilance when receiving unsolicited communications that request your immediate action, especially if these messages contain embedded buttons and URL links.

If DHL or any other shipping service requires your action, you should always open the real website on a new browser tab instead of clicking on the provided links.

From there, log in to your account on the platform, and check for any pending items or alerts. Alternatively, contact a customer support agent yourself.

In this case, the spoofed DHL domain is "dhiparcel", which is a clear sign of phishing that may be missed if you don't look closely before jumping into action.