‘Tis the Season for the Wayward Package Phish
Summary: A Krebs on Security report describes an SMS phishing campaign that spoofs FedEx with a fake undelivered-package notice, sending recipients to domains such as o001cfedeex[.]com that redirect desktop visitors to a car-insurance ad page but load a returns-fedex[.]com landing page on mobile devices. The fake site collects name, address, phone number, date of birth, a payment card for a $2.20 redelivery fee, and then Social Security number, driver's license number, email address and email password, before redirecting victims to the real Fedex.com.
What's compelling: More than three dozen other newly registered FedEx phishing domains resolve to the same address, 23.92.29[.]42, behind Cloudflare, so the campaign has infrastructure to spare after any single domain stops resolving.
Read the original at Krebs on Security ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026