Thanks FedEx, This Is Why We Keep Getting Phished (2024)

3 hours ago

Phishing SMS pretending to be parcel delivery services are common, but this one turned out to be a real FedEx notification.
The SMS contained multiple red flags: typos, urgency, odd URLs, and mismatched details.
An 87% majority of respondents to a poll considered the message 'dodgy AF'.
Investigation revealed the BPOINT payment link was vulnerable to parameter tampering, but it was a legitimate service.
A follow-up SMS was even more broken, with a non-functional link and inconsistent capitalization.
Calling FedEx directly confirmed the shipment and fees, and an email with the invoice proved authenticity.
The real danger is that legitimate companies like FedEx can inadvertently mimic scammers, making it hard for users to distinguish.
Technical controls alone are insufficient; human awareness of scam patterns remains crucial.

Anti-fraud tools lag behind scammers who exploit cheap internet calling and artificial intelligence.
No single solution exists; authentication, traceback, call blocking, and enforcement must work together.
STIR/SHAKEN authentication is not a silver bullet; bad actors obtain legitimate numbers to bypass it.

Group chats on major messaging services are end-to-end encrypted but vulnerable to content manipulation by malicious group members or compromised devices.
Attackers can send messages with the same ID but different content to different recipients, breaking transcript consistency.
Examples include fake meeting invitations, manipulated polls, and hidden malware links disguised as harmless content.

The author encountered a seemingly legitimate Cloudflare product page that exhibited multiple signs of a phishing attack, such as an unfamiliar domain and a suspicious permission request.
Despite initial suspicion, the product ('Wallet') was later confirmed to be legitimate, highlighting the difficulty in distinguishing real sites from phishing attempts.
The author criticizes the lack of best practices, including a missing 'Report' option and a misleading green checkmark UI element, and urges developers to follow security standards.

Anti-fraud tools lag behind scammers who exploit cheap internet calling and artificial intelligence.
No single solution exists; authentication, traceback, call blocking, and enforcement must work together.
STIR/SHAKEN authentication is not a silver bullet; bad actors obtain legitimate numbers to bypass it.

Group chats on major messaging services are end-to-end encrypted but vulnerable to content manipulation by malicious group members or compromised devices.
Attackers can send messages with the same ID but different content to different recipients, breaking transcript consistency.
Examples include fake meeting invitations, manipulated polls, and hidden malware links disguised as harmless content.

The author encountered a seemingly legitimate Cloudflare product page that exhibited multiple signs of a phishing attack, such as an unfamiliar domain and a suspicious permission request.
Despite initial suspicion, the product ('Wallet') was later confirmed to be legitimate, highlighting the difficulty in distinguishing real sites from phishing attempts.
The author criticizes the lack of best practices, including a missing 'Report' option and a misleading green checkmark UI element, and urges developers to follow security standards.

Hasty Briefsbeta