---
title: Phish Wire - Feb 11 2025
description: Online threats continue to evolve quickly, with recent reports highlighting a substantial rise in UPS phishing attempts, reflecting the growth in online shopping as consumers capitalized on post-holiday sales.
image: https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/Phish%20Wire%20Header%20feb%2011.png
---
[Skip to content](https://blog.identityautomation.com/phish-wire/phish-wire-feb-11-2025#main-content)
[Identity Automation is now part of Jamf. Visit Jamf.com](https://jamf.com/)
- [Request a Demo](https://www.identityautomation.com/request-a-demo)
- [Contact Us](https://www.identityautomation.com/contact)
[](https://www.identityautomation.com)
Menu
- Products
Show submenu for Products
- Identity Solutions
Show submenu for Identity Solutions
- [Identity Lifecycle Management](https://www.identityautomation.com/products/identity-lifecycle-management/)
- [Access Governance](https://www.identityautomation.com/products/access-governance)
- [Authentication](https://www.identityautomation.com/products/authentication)
- [Threat Detection & Response](https://www.identityautomation.com/products/threat-detection-and-response)
- [FusionID](https://www.identityautomation.com/fusionid)
- Classroom Solutions
Show submenu for Classroom Solutions
- [Student-Teacher Portal](https://www.identityautomation.com/products/student-teacher-portal)
- [Rostering](https://www.identityautomation.com/products/rostering)
- [Insights](https://www.identityautomation.com/products/insights)
- Industries
Show submenu for Industries
- [K-12](https://www.identityautomation.com/industries/k-12-education)
- [Higher Ed](https://www.identityautomation.com/industries/higher-ed)
- [Healthcare](https://www.identityautomation.com/industries/healthcare)
- Resources
Show submenu for Resources
- [Knowledge Base](https://blog.identityautomation.com/)
- [PhishWire](https://blog.identityautomation.com/phish-wire)
- [Events](https://www.identityautomation.com/resources/events)
- [Support](https://help.rapididentity.com/)
- [Trust Center](https://www.identityautomation.com/trust-center)
- [SSO & Rostering Integrations](https://www.identityautomation.com/sso-rostering-integration)
- [About Us](https://www.identityautomation.com/about-us)
Show submenu for About Us
- [Why IA?](https://www.identityautomation.com/why-ia)
- [Careers](https://www.jamf.com/about/careers/)
- Products
Show submenu for Products
- Identity Solutions
Show submenu for Identity Solutions
- [Identity Lifecycle Management](https://www.identityautomation.com/products/identity-lifecycle-management/)
- [Access Governance](https://www.identityautomation.com/products/access-governance)
- [Authentication](https://www.identityautomation.com/products/authentication)
- [Threat Detection & Response](https://www.identityautomation.com/products/threat-detection-and-response)
- [FusionID](https://www.identityautomation.com/fusionid)
- Classroom Solutions
Show submenu for Classroom Solutions
- [Student-Teacher Portal](https://www.identityautomation.com/products/student-teacher-portal)
- [Rostering](https://www.identityautomation.com/products/rostering)
- [Insights](https://www.identityautomation.com/products/insights)
- Industries
Show submenu for Industries
- [K-12](https://www.identityautomation.com/industries/k-12-education)
- [Higher Ed](https://www.identityautomation.com/industries/higher-ed)
- [Healthcare](https://www.identityautomation.com/industries/healthcare)
- Resources
Show submenu for Resources
- [Knowledge Base](https://blog.identityautomation.com/)
- [PhishWire](https://blog.identityautomation.com/phish-wire)
- [Events](https://www.identityautomation.com/resources/events)
- [Support](https://help.rapididentity.com/)
- [Trust Center](https://www.identityautomation.com/trust-center)
- [SSO & Rostering Integrations](https://www.identityautomation.com/sso-rostering-integration)
- [About Us](https://www.identityautomation.com/about-us)
Show submenu for About Us
- [Why IA?](https://www.identityautomation.com/why-ia)
- [Careers](https://www.jamf.com/about/careers/)
# Phish Wire - Feb 11 2025
[by Identity Automation](https://blog.identityautomation.com/phish-wire/author/identity-automation)
Online threats continue to evolve quickly, with recent reports highlighting a substantial rise in UPS phishing attempts, reflecting the growth in online shopping as consumers capitalized on post-holiday sales. We've also observed a rise in phishing attacks targeting both Chase Bank and OneDrive users. In this edition of Phish Wire, we'll focus on these trends, highlighting key examples and offering insights to help you stay vigilant against these ongoing threats.
- 0nlinesecuremessagetransmission\[.\]afsinvestmentplansfile\[.\]sbs/?JgTXv=Ww21
- vfb-bilder\[.\]de/wp-includes/images/one-drv11\[.\]html
- jm01dn22-cpmor00eu\[.\]com/C0nf1rmat1on-4FC758187/
- j07en03us-pm07sou09eu\[.\]es/C0nf1rmat1on-748564865
- usps\[.\]com-trackhnu\[.\]top/us
- usps\[.\]com-tracktho\[.\]top/i
- usps\[.\]com-trackvjs\[.\]top/us
- usps\[.\]com-trackqfg\[.\]top/us
**Traceless Microsoft Spearphish**
A Texas administrator clicked on a Microsoft spearphish that referenced accessing a file. Upon investigation, the IT supervisor found no trace of the link delivered through the corporate mailbox and concluded that it was clicked from a malicious file share or an attachment in a personal email. A very similar case occurred the same day when a staff member clicked a Microsoft spearphish referencing a secure message that also left no trace in the corporate mailbox.
.png)
**USPS Explosion**
During the holidays, there was a significant increase in USPS smishing and phishing scams, taking advantage of the anxiety surrounding timely package deliveries. Sixteen different UPS phishing links were identified and clicked on by approximately thirty users.
To summarize the scam, these attacks begin with a ‘Delivery Failure’ notification that urges the recipient to update their address for a package set to arrive by a certain date. After updating the address, the user is prompted to pay a small ‘redelivery service fee’ and provide their credit card information.
We observed a significant increase in variants of this phishing attack clicked by users throughout the US. The table below displays a list of links clicked by users in Texas, Kentucky, Washington, Idaho, and California.
**Mitigations**
- Add the specified domains to your block lists.
- Focus awareness efforts on high-risk credentials.
- Remind users of rampant USPS phishing scams over the holidays.
- Educate users that phishing in their personal email can pose serious risks to their organization.
Dec 19, 2025
### Related Content
[All Resources](https://blog.identityautomation.com/phish-wire)
[](https://blog.identityautomation.com/phish-wire/phish-wire-december-8-2025)
Jan 15, 2026, 11:53:13 AM
##### [Phish Wire - December 8, 2025](https://blog.identityautomation.com/phish-wire/phish-wire-december-8-2025)
The last two weeks have experienced an increase in spearphishing targeting corporate users on their...
[](https://blog.identityautomation.com/phish-wire/phish-wire-march-11-2025)
Dec 19, 2025, 7:41:32 AM
##### [Phish Wire - March 11 2025](https://blog.identityautomation.com/phish-wire/phish-wire-march-11-2025)
There have been record surges in zero day phishing activity via social media and business...
[](https://blog.identityautomation.com/phish-wire/phish-wire-march-18-2025)
Dec 19, 2025, 7:42:22 AM
##### [Phish Wire - March 18 2025](https://blog.identityautomation.com/phish-wire/phish-wire-march-18-2025)
The past two weeks saw a record surge in zero-day spearphish targeting credentials from Microsoft...
[](https://blog.identityautomation.com/phish-wire/phish-wire-july-22-2025)
Dec 19, 2025, 7:49:24 AM
##### [Phish Wire - July 22 2025](https://blog.identityautomation.com/phish-wire/phish-wire-july-22-2025)
In mid-July, there was an increase in spear-phishing attacks targeting users who were working from...
[.png?width=276&height=100&name=IA-a-Jamf-Company_stacked-darkmode@451x164%20(1).png "IA-a-Jamf-Company_stacked-darkmode@451x164 (1)")](https://www.identityautomation.com)
- Identity Solutions
- [Identity Lifecycle Management](https://www.identityautomation.com/products/identity-lifecycle-management/)
- [Access Governance](https://www.identityautomation.com/products/access-governance)
- [Authentication](https://www.identityautomation.com/products/authentication)
- [Threat Detection & Response](https://www.identityautomation.com/products/threat-detection-and-response)
- [FusionID](https://www.identityautomation.com/fusionid)
- Classroom Solutions
- [Student-Teacher Portal](https://www.identityautomation.com/products/student-teacher-portal)
- [Rostering](https://www.identityautomation.com/products/rostering)
- [Insights](https://www.identityautomation.com/products/insights)
- Industries
- [K-12](https://www.identityautomation.com/industries/k-12-education)
- [Higher Ed](https://www.identityautomation.com/industries/higher-ed)
- [Healthcare](https://www.identityautomation.com/industries/healthcare)
- Resources
- [Knowledge Base](https://blog.identityautomation.com)
- [Events](https://www.identityautomation.com/resources/events)
- [Support](https://help.rapididentity.com/)
- [Trust Center](https://www.identityautomation.com/trust-center)
- [SSO & Rostering Integrations](https://www.identityautomation.com/sso-rostering-integration)
- [About Us](https://www.identityautomation.com/about-us)
- [Why IA?](https://www.identityautomation.com/why-ia)
- [Careers](https://www.jamf.com/about/careers/)
- DIR-CPO
- [DIR-CPO-4849](https://www.identityautomation.com/dir-cpo-4849)
- [DIR-CPO-5694](https://www.identityautomation.com/dir-cpo-5694)
[Contact Us](https://www.identityautomation.com/contact)
[Request A Demo](https://www.identityautomation.com/request-a-demo)
[Privacy Policy](https://www.identityautomation.com/privacy-policy)
[Terms & Conditions](https://www.identityautomation.com/terms-of-use)
© 2026 | All Rights Reserved
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Identity Automation",
"url" : "https://blog.identityautomation.com/phish-wire/author/identity-automation"
},
"dateModified" : "2025-12-19T13:37:05.673Z",
"datePublished" : "2025-12-19T13:37:05.000Z",
"headline" : "Phish Wire - Feb 11 2025",
"image" : [ "https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/Phish%20Wire%20Header%20feb%2011.png" ],
"mainEntityOfPage" : {
"@id" : "https://blog.identityautomation.com/phish-wire/phish-wire-feb-11-2025",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.identityautomation.com/hubfs/Singularity/logos/id-auto-logo-mark-black.svg"
},
"name" : "Identity Automation (A Jamf Company)"
}
}
```