Threat actors are out to steal shoppers‘ credit card credentials with a fraudulent address verification request.
The holiday season at the end of the year is a busy time for online shoppers, between taking advantage of the best Black Friday and Cyber Monday deals and ordering gifts for friends and family. Sadly, threat actors have no qualms with taking advantage of the high volume of packages in transit during this time to conduct widespread cyberattacks against their recipients. We recently encountered one such attack in the form of a phishing campaign masquerading as a United States Postal Service (USPS) notification service. This particular phishing campaign is designed to lure users to a fraudulent USPS website, then trick users into handing over their credit card information.We have received multiple reports of users receiving fraudulent text messages informing them that a package cannot be delivered because the shipping address could not be verified. The messages then direct recipients to resubmit their addresses for verification by following a hyperlink at the end of the message.
