Coronavirus Phishing Scams

Health concerns aren't the only thing you need to watch out for in the pandemic. Cybercriminals are taking full advantage of the world's confusion by targeting people and businesses when they're at their most vulnerable. While cybercrime of all kinds is on the rise, phishing has emerged as a current favorite of coronavirus scammers.
 
As of May 1, the U.K. has reported 4,727 coronavirus-related phishing emails, leading to more than £2 million in losses. In the U.S., damages from these emails have surpassed $4 million as of May 11. Many of these scams use similar tactics, so here are a few of the most common ones you may encounter.
 
Impersonating Health Authorities
As you might have predicted, many phishers are sending emails under the guise of official health figures. By pretending to be an authority like the World Health Organization (WHO), cybercriminals fool unsuspecting users into clicking malicious links. Amid all the confusion surrounding the virus, people may let their guard down, desperate for information.
 
These emails impersonate official sources offering updates on the spread of the virus. Since many of these organizations are sending out regular updates, you can see why people may fall for these scams. Since they contain relevant subject lines like "Coronavirus Updates" or "COVID-19 News," email filters may not label them as spam, either.
 
Fraudulent Outbreak Maps
A similar and equally prevalent scheme is to present a malicious link to an outbreak map. This scam is particularly effective because Johns Hopkins University has released an official interactive COVID-19 map. Some phishing attempts link to the Johns Hopkins map but install AzorUlt Trojans in the process.
 
Other similar campaigns involve mimicking the official map but taking users to a fraudulent, malware-infested one instead. Like with phishing scams parading as the WHO, these attempts take advantage of users' desire for information. In their haste to learn more, they may not double-check to see if the source is legitimate or not.
 
Imitating Government Officials
Health organizations aren't the only groups that coronavirus phishers are impersonating. Many governments are providing monetary or informational support to their citizens, which presents cybercriminals with the perfect opportunity. Scammers pretending to represent the U.S. CARES Act or the U.K.'s HMRC are on the rise.
Businesses are especially susceptible to these scams, as many government programs offer tax relief or loan forgiveness for companies. Unfortunately, organizations also have the most to lose, risking both their livelihood and reputation in the event of identity fraud. Global economies are already in decline, making these scams all the more devastating.
 
Tips on Avoiding Coronavirus Phishing
While the pandemic has spurred a rise in phishing, you aren't defenseless against these scams. You and your business can avoid falling prey to coronavirus phishers by maintaining safe internet practices. Amid all the confusion, you mustn't lose sight of basic cybersecurity measures. 
 
Understanding what forms many of these scams take is the first step in preparedness. Know that almost 20% of all phishing emails today include coronavirus-related information or content. You should subject anything containing this type of material to additional scrutiny.
 
The only thing separating these new scams from older ones is their prevalence and the growing public confusion. If you take the time to remember foundational security measures like inspecting links and not clicking on unknown addresses, you'll be safe. Here are some reminders to keep in mind: 
  • Always verify an email's source before clicking any links or opening attachments.
  • Just because an email address looks official doesn't mean it is.
  • Never give personal information away over email.
  • Government agencies will never ask for you for money, especially in cryptocurrency.
  • If anything sounds too good to be true, it probably is.
  • For information regarding COVID-19, check official sources like the WHO's website, not emails. 
Protecting Your Business During COVID-19
If you practiced safe email behavior before the outbreak, you should be safe. Just remember to continue these practices, and double-check everything if you didn't already. These are confusing times for everyone, but you can't afford to let your guard down.
 
Many things are changing in response to the pandemic, but the threat of phishing hasn't. Cybercrime is as prevalent as ever, so make sure you and your business are taking steps to defend against it. The phishing scams of the coronavirus are a growing threat, but you can handle it with robust cybersecurity.
 
Caleb Danziger writes about science and technology at TheByteBeat.com
 
You Might Also Read:
 
Spear Phishing Threats & Trends:
 
 
« CISO's Cant Find The Right People
‘We Hacked Your Website’ Blackmail Scam »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Arista Networks

Arista Networks

Arista Networks is an industry leader in data-driven, client to cloud networking for large data center, campus and routing environments.

Certification Europe

Certification Europe

Certification Europe (now Amtivo Ireland) is an accredited certification body which provides ISO management system certification, including ISO 27001.

Zymr

Zymr

Zymr specialize in cloud computing solutions including Cloud Security, Cloud Mobility, Cloud Apps, Cloud Infrastructure and Cloud Orchestration.

MSAB

MSAB

MSAB is a pioneer in forensic technology for mobile device examination.

Destel

Destel

Destel is a system integrator and provider of IT services focused on Advanced Network & Security Solutions.

WISeKey

WISeKey

WISeKey is a leading cybersecurity company currently deploying large scale digital identity ecosystems for people and objects using Blockchain, AI and IoT.

Garland Technology

Garland Technology

Garland Technology specializes in network access points (TAPs) for 100% visibility allowing you to see every bit, byte, and packet flowing through your network.

Specops Software

Specops Software

Specops Software is a leading password management and authentication solution vendor.

Open Systems

Open Systems

Open Systems is a Secure Access Service Edge (SASE) pioneer delivering a complete solution to network and security.

NETRIO

NETRIO

If you are looking for a highly mature, exceptionally competent Managed Service Provider, NETRIO has solutions to keep your business running at warp speed with zero disruptions.

Cybriant

Cybriant

Cybriant Strategic Security Services provide a framework for architecting, constructing, and maintaining a secure business with policy and performance alignment.

Path Forward IT

Path Forward IT

Path Forward IT has been troubleshooting, architecting, migrating, protecting, and securing IT environments for businesses across the USA since 2002.

SK Shieldus

SK Shieldus

SK shieldus are a converged security provider with business capabilities in both cybersecurity and physical security based on Big-Tech.

SEALSQ

SEALSQ

For the last 25 years, SEALSQ have been developing secure semiconductor chips, secure embedded firmware, and tested hardware provisioning services to serve the vision of a safer connected world.

OutKept

OutKept

OutKept offers the highest quality phishing simulation campaigns, supported by a community of ethical phishers, to build awareness, and maintain alertness.

Vault Cloud

Vault Cloud

Vault Cloud, Australia's National Cloud, is an Australian owned and operated company specialising in secure, sovereign, hyperscale cloud infrastructure.