With the Coronavirus dominating world news at the moment, many of us are justifiably concerned and preparing ourselves by keeping informed on the current situation and guidance. Sadly, there are those in society that see this as an opportunity for personal or financial gain, and we are starting to see phishing campaigns preying on people’s curiosity for information on the subject using Coronavirus Phishing Emails.
Please take extra care with e-mails (both at home and work) around this subject. As always, general best advice to protect from Coronavirus Phishing Emails is as follows from:
- Many phishing scams start from overseas and often having few mistakes such as the spelling, grammar or the punctuation are poor. Many scammers successfully create official-looking emails by including real company logos and graphics. Is the design (and quality) what would you’d expect from a large organisation?
- Is it addressed to you by name, or does it refer to ‘valued customer’, or ‘friend’, or ‘colleague’? This can be a sign that the sender does not actually know you, and that it is part of a phishing scam.
- Does the email contain a cover threat that asks you to act urgently or as soon as possible? However, you must pay attention to the suspicious words like ‘send these details within 12 hours’ or ‘you have been a victim of crime, click on this link immediately’ or download this application.
- Look out for emails that appear to come from a high-ranking person within the organisation, requesting a payment is made to a particular bank account. Also, look at the sender’s name. Does it sound lawful, or is it trying to imitate someone you know?
- If it feels that it is true, it probably is. It’s most unlikely that someone will want to give you money, or give you access to some secret part of the Internet.
- Am I expecting this e-mail from this person?
Federal Bureau of Investigation (FBI is a government agency in the United States of America that investigates crimes) warns that COVID-19 scammers Targeting these Three States:
The FBI has warned that there is a significant spike in coronavirus digital scams in the recent time. However, according to the FBI Cyber Division, these threat actors from outside the USA and they are mainly targeting three states and keep on sending Coronavirus Phishing Emails.
As per the Forbes article published on 21st March 2020, two leading cyber crime groups responsible for ransomware attacks had promised that they will not target two types of organizations during the coronavirus pandemic. These are healthcare and medical organizations.
One cyber-security expert informs that despite their promise, there are thousands of cyber-criminals out there who can do perform cyber-attack.
California, New York and Washington are in the hit list of cyber-criminals. Two things are clear in the interview with Stapleton who is the Section Chief Herb Stapleton of the FBI Cyber Division. One is, all types of coronavirus-related cyber-attacks against USA are originating from outside America. Second is, spikes in the cyber-crimes are high in the states where COVID-19 infection rates are high.
Ilia Kolochenko, founder & CEO of web security company ImmuniWeb advise people to stay alert and double-check the authenticity of any phone calls or incoming messages or emails. And specially pay attention when some trying to take out any data from you in an emergency saying that there is no time explain the real context.
Types of Malware used for Phishing: Two types of malware used for Phishing are trojans and ransomware.
Trojans: Its a type of malware that is often disguised as legitimate software. Trojans can be used by cyber-thieves and hackers to gain the access to users’ systems. If this software downloaded in computer system, it would perform like the intended legal application but in reality doing some malicious things in the background. AzorUlt Trojan is used in these COVID-19 emails.
Ransomware: It is a malware from cryptovirology (it is the study of cryptography to design powerful malicious software). If ransomware downloaded by mistake, it can carry company, organization or individual’s data. It threatens to publish this data or block access to system unless a ransom is paid. Bad Rabbit ransomware is the good example of it.
Coronavirus Phishing Emails sample 1
We are health experts team from WHO(World Health Organization) sending you very important health instructions in .rar file. Also, there are instructions that how you can get the COVID-19 vaccine for free. You have to download the file, unzip it and read the instructions carefully.
Also, send this information to all your loved ones as quickly as possible. We want to save the lives as much possible.
rar file password is: 143143
Thanks and Regards
World Health Organization, USA
004 Independence Avenue,
Washington DC 44301.
Contact number: +1 202 974 3334
Covid-19 Phishing Emails sample 2
(In this example, notice how they provide the links that with https; rather than https: This is a very common method to use similar characters so that users won’t feel the difference & will click on the given link.).
The outbreak of Coronavirus is affecting the whole world. It will surely be impacting the travel plans over the coming months. We suggest you, if you are travelling or planning to travel takes proper guidance from the National Institutes of Health (NIH) office.
NIH team has combined some useful information for you based on current activities. If the WHO warns against the place, you are visiting then you must contact your travel operator or medical practitioner to reschedule the trip.
Kindly take a moment and read the detailed article on our website at below link.
Stay alert & Stay healthy.
Thanks & Best Regards
National Institutes of Health (NIH)
Address: W Pima St & E Pima St, Sacaton,
AZ 85147, United States of America.
Phone: +1 520-562-3113.
Phishing Email Example 3
However, in this type of example, the link redirects you to a target page where page asking you to login to your Outlook account. This seemingly harmless login page, which is actually stealing those credentials.
Please to update you that Coronavirus (COVID-19) has been reached to 165 countries so far. Kindly check the latest information provided by WHO (World Health Organization) at below link.
Thanks and Best Regards
Berlin Institute of Health
10178 Berlin, Germany
Contact number: +49 30 450543769
Top 9 Phishing Simulators: Below are the best Phishing tools.
- Infosec IQ
- Simple Phishing Toolkit (sptoolkit)
- Phishing Frenzy
- SpearPhisher BETA
- King Phisher
- Social-Engineer Toolkit (SET).
- SpeedPhish Framework (SPF).
we will write another article on these tools with more details. Please stay in touch and keep reading Guide4info articles.
In this advance digital world, Please stay aware & Stay safe.