India’s Computer Emergency Response Team (CERT-In) warned exporters about phishing campaigns distributing fake Jawaharlal Nehru Port Trust cargo clearance PDFs that mimic customs seals and bill-of-entry numbers, attempting to harvest login credentials for ICEGATE and port community systems ahead of Diwali shipping peaks. The advisory, graded for immediate action, follows a spike in complaints from freight forwarders at Nhava Sheva who received lookalike messages claiming containers would be demurrage-blocked unless recipients clicked embedded links.
Attack pattern
Threat actors reuse publicly posted vessel schedules and container numbers scraped from tracking portals, then embed them in messages appearing to originate from cha agents. PDF attachments carry pixel-perfect seal graphics but hash to domains registered in the last fortnight. CERT-In asked organisations to verify clearance status only through authenticated ICEGATE sessions and to report domains to the National Cyber Crime Reporting Portal.
Operational impact
JNPT operators said legitimate clearance workflows never demand password re-entry via email attachments. Customs brokers urged staff to call known desk numbers instead of replying to WhatsApp forwards, a channel fraudsters increasingly favour for urgency language. Exporters racing to close letters of credit before holiday bank holidays face higher exposure if a single compromised credential propagates across linked GST and shipping accounts.
Mitigation steps
CERT-In recommends disabling macro execution, deploying DMARC on corporate domains, and isolating port-facing workstations from general office LANs. Multi-factor authentication on ICEGATE, mandated in prior circulars, remains the decisive control when passwords leak. For security teams, the lesson this week is seasonal: port-themed lures spike whenever container yards congestion headlines trade press, even when underlying cargo volumes are routine.
Industry response
The Customs Brokers Association of India circulated a template verification checklist to members at Nhava Sheva, urging dual confirmation on any message referencing demurrage waivers. Shipping lines Maersk and MSC published their own reminders that berth updates appear only on authenticated portal dashboards, not PDF attachments.
Historical pattern
Similar lures appeared during the 2024 Red Sea diversion surge when exporters chased rerouting instructions; CERT-In’s current note references that playbook so SOCs can reuse detection rules. Organisations that ran phishing simulations in September reported click rates below three percent among finance staff, a baseline port-themed drills will test again this week.