Fake UPS/FedEx/DHL email

Every year around this time, we see a significant increase in the volume of fake email claiming to be from UPS, FedEx, DHL, etc. Please examine these messages carefully before opening/saving an attachment or clicking on a link.

The attachments claim to be an invoice, shipment tracking, or some other important document but are actually malware disguised as a PDF, ZIP or program. UPS and FedEx never email this content.

The links claim to let you track a package, register your account, or stop UPS from disabling your account. The links will look legitimate but if you hover over them or view the email source, you will see that the links actually take you to fake sites. Here is an email that was sent to dozens of people today. The link appears to be webapps.ups.com but actually downloads a ZIP file from documents-receive.com:

UPS malware 20141202-1057


If you receive any suspicious email, please forward to security@usc.edu so we can analyze and block if necessary. Thank you.