Remove “DHL – YOUR PARCEL HAS BEEN DELIVERED” email

The “DHL – YOUR PARCEL HAS BEEN DELIVERED” email is part of a phishing campaign and is disguised as a parcel delivery notification from DHL. The email claims that the parcel in question has been processed and is in transit. The email includes fake information about the shipment and two attached files. If users try to open the attached files, they will be taken to a phishing site that asks them to log in to their email accounts because the files are supposedly protected documents. If users enter their login credentials, they will be sent to the malicious actors behind this phishing campaign.

 

 

Phishing emails posing as parcel delivery notifications are fairly common, as people often open attachments or click on links without hesitation. This particular email claims that a parcel is in transit and will soon be delivered. The email claims that the two attached files are the shipping document, an invoice, and a DHL receipt for tracking purposes. However, if users open the files, they will be shown a pop-up asking them to log in to their accounts.

If users enter their information on this phishing site, it will be stolen by the malicious actors behind the campaign. Email login credentials are very valuable to malicious actors because email accounts not only often have a lot of personal information, but are also connected to many other accounts. Thus, gaining access to an email account could result in other accounts being hijacked as well.

The full contents of the “DHL – YOUR PARCEL HAS BEEN DELIVERED” malicious email are below:

Subject: DHL Shipment Notification: Notice of Parcel Arrival for AWB #4014983405

DHL
YOUR PARCEL HAS BEEN DELIVERED

Hello ********,

We are pleased to inform you that your shipment has been processed and is now in transit to you via DHL. Below are the details of your shipment for your reference.

SHIPMENT Information
Waybill No. 4014983405
consignee. ********
ETA. 27 Aug 2025

Kindly review the attached file, which contains the shipping document, invoice and DHL receipt for tracking purposes.

If you have any questions or need further assistance, please contact DHL customer service.

DHL Express – Excellence. Simply delivered.

How to recognize phishing emails?

Generic phishing emails sent to a large number of recipients are often easy to recognize because they do not mention specific information, have many grammar and spelling mistakes, and overall seem very unprofessional. More sophisticated phishing attempts tend to target specific individuals or companies, and mention specific details to appear more credible. Fortunately, most users primarily encounter generic phishing emails.

When users receive an email that asks them to do something (e.g., click on a link), their first step should be to verify the sender’s email address. Users can verify an address by looking it up online to see if it matches the sender or organization it claims to be from. Suspicious email addresses often appear random, making them easier to spot. For example, this “DHL – YOUR PARCEL HAS BEEN DELIVERED” email is clearly not sent by DHL because it doesn’t use DHL’s official domain. However, cybercriminals can mask their emails by tweaking letters or adding characters to resemble real companies, so staying alert is key.

Another common warning sign in phishing emails is poor grammar and spelling mistakes. Although shorter emails may contain fewer errors, glaring mistakes are still very common. Official correspondence from reputable service providers, such as DHL, will not contain such mistakes, as they appear unprofessional and raise suspicion. The “DHL – YOUR PARCEL HAS BEEN DELIVERED” email does not have obvious mistakes, but it does have awkward and unprofessional phrasing that you would not see in a legitimate DHL email. Furthermore, the email addresses the recipient using the email username instead of their name.

It is essential to avoid acting impulsively when dealing with these emails, especially if they demand immediate action. Users should take the time to carefully evaluate the email’s legitimacy and determine whether it is reasonable or credible. If they are not expecting a parcel, then there’s no reason to pay any attention to the contents of this particular email.

Remove “DHL – YOUR PARCEL HAS BEEN DELIVERED” email

The “DHL – YOUR PARCEL HAS BEEN DELIVERED” email can be safely deleted. If users have already clicked the link and entered their email login credentials, they need to change their passwords immediately. If the account can no longer be accessed, users should disconnect the address from any connected accounts to prevent them from being hijacked as well.