Popular Types Of Phishing Emails

In early 2020,  cloud security expert, Wandera, revealed in its Mobile Threat Landscape Report that a new phishing campaig is launched every 20 seconds. That means three additional phishing sites designed to target users in every minute. 

However, this number no longer applies during COVID-19 times. Phishing has seen a rapid increase starting from when the pandemic went global during the first quarter of 2020. According to security firm Barracuda Networks, there was a 667% spike in email phishing attacks in March 2020 due to coronavirus fears. This new data reveals how cybercriminals are taking advantage of the people’s concerns due to the pandemic. 

This increase in phishing scams is not unique to corona-related attacks alone. There has also been an increase in invoice scams and credential theft as the whole world switches to work-from-home arrangements. 

The best way to guard against phishing scams is early detection. Being able to determine a phishing email from a legitimate email helps a lot in preventing the nasty consequences of phishing campaigns, including data theft, malware infection, money theft, and others. Protecting your privacy by using a VPN also minimizes your chance of being targeted by phishing attacks. 

To understand more about the enemy, we’ve gathered the latest and most widely-used phishing tactics in 2020. We’ve listed their characteristics and how to recognize each of them. 

Scam #1: Corona-related phishing attacks

As mentioned above, the most popular phishing strategy right now piggybacks on the public’s fear of the coronavirus. In March alone, Barracuda has detected 9,116 COVID-19-related attacks, which represents 2% of the total 467,825 spear-phishing email attacks detected for that month alone. 

There are three main types of attacks that use the coronavirus as the hook: scamming, brand impersonation, and business email compromise. Some of the scams you need to watch out for include fake corona cures, face masks, donation requests for companies that claim to be developing vaccines, and fake charities. Some scams even claim to be from the World Health Organization, asking for donations through Bitcoin. 

Aside from scams, attackers also deploy malware through phishing emails. Some of the well-known malware related to COVID-19 are Emotet, a popular banking Trojan, the Ursnif banking Trojan, the Fareit information stealer, the COVID-19 ransomware, Azorult, NetWalker, Nanocore RAT, and the Hancitor trojan.

Scam #2: Invoice phishing scams

With so many people forced to work at home because of the pandemic, most of the business transactions are done online, including financial processes such as payroll and invoicing. As a result, attackers who specialize in invoice phishing scams have more victims to target. This type of phishing involves sending a payment reminder to a vendor, brand, and even individuals, letting the receiver know that an important invoice is attached. Clicking the invoice could either redirect the user to a phishing website where he or she is directed to pay the invoice or a malware/ransomware could be downloaded to the victim’s computer. 

Scam #3: Update payment alerts

Aside from invoice phishing, update payment alerts are also common nowadays. No one would want to suffer from a service outage, especially during this crisis. This is what makes update payment scams so effective. Imagine getting an email about your internet company terminating your connection if you’re not updated with your payments or receiving an email from Netflix temporarily restricting your account until your balance has been paid off. In the time of the COVID-19 pandemic, nothing could be scarier than having no internet or Netflix. 

And hackers are feeding on the people’s dependence on these services to gain money. They usually send an email stating that there is a problem with your credit card or there is an issue with your payment, asking you to log in and update your payment details. Some attackers go as far as hacking the company and identify the employee responsible for managing accounts like these. 

Scam #4: Security Alerts

This type of phishing scam never gets olds. In fact, it is a daily occurrence. But getting security alerts from banks, email providers, and cloud services companies can be troubling, especially since the emails are becoming more sophisticated in their imitation of legitimate companies. These phishing emails actually look very real and something that users have seen before. Common security alerts include expiring password warnings, suspicious activity detected, suspicious logins, and others. When the user clicks the link, the victims are actually compromising their privacy instead of protecting it.

How to Protect Against Phishing Scams

Your first defense against scams like these is to be aware that they exist. By being aware, you’ll be more vigilant when you open your emails. Here are some ways to determine the authenticity of the emails you receive:

  • Check the sender’s email. Compare the email address with the previous emails you received from that business or company. If the domain extension is different, then that’s probably a scam. 
  • Use a reliable VPN to help you stay anonymous online. This will minimize the personal information that hackers can collect from you that can be used for phishing. Check out VPN review sites, such as VPN Watch, where you can find a top security solution for your needs.
  • Don’t click on links or attachments without verifying the authenticity of the email. If you have other contact details of the sender, confirm with him or her about the email you received. 
  • Check the grammar. Professional emails from businesses and companies undergo proofreading to make sure that it looks and sounds professional. If it sounds like it was churned out by a translating machine, then be suspicious. 
  • Do not log into your account by clicking on the link. Open a separate browser and visit your account from there to verify if there have been any changes. 

And what do you do if you get a phishing email? Delete them. 

By April Reyes 

You Might Also Read: 

All Employees Need This Effective New Training Tool:

 

 

« Five Ways Automation Can Help Fix The Cybersecurity Skills Shortage
Attacks On Anti-Racism Sites Surge »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Hack Miami

Hack Miami

HackMiami is the premier resource in South Florida for highly skilled hackers that specialize in vulnerability analysis, penetration testing, digital forensics, and all manner of IT security.

Rackspace Technology

Rackspace Technology

Rackspace Technology is a leading provider of managed services across all major public and private cloud technologies. Secure your IT environments with powerful cloud security solutions and support.

Information Commissioner's Office (ICO)

Information Commissioner's Office (ICO)

The Information Commissioner's Office is an independent authority set up to uphold information rights in the public interest.

Karamba Security

Karamba Security

Karamba provide an IoT Security solution for ECUs in automobiles which ensures that all cars are protected (not just autonomous cars).

KoolSpan

KoolSpan

KoolSpan’s security and privacy solutions address the growing threat of loss or theft of intellectual property, information, and proprietary assets.

France Cybersecurity

France Cybersecurity

France Cybersecurity represents the French cybersecurity industry to raise international awareness of French cybersecurity capabilities and solutions.

Dispersive Networks

Dispersive Networks

Dispersive Virtual Network is a carrier-grade software-defined programmable network that is inspired by battlefield-proven wireless radio techniques.

TÜV Informationstechnik (TÜViT)

TÜV Informationstechnik (TÜViT)

TÜViT is a leading service provider in the IT sector offering unbiased and independent tests and certifications of IT products, hardware, software, systems and processes.

Swiss Cyber Storm

Swiss Cyber Storm

Swiss Cyber Storm is a non profit organization hosting the international Swiss Cyber Storm Conference and running the Swiss part of the European Cyber Security Challenges.

Irish National Accreditation Board (INAB)

Irish National Accreditation Board (INAB)

INAB is the national accreditation body for Ireland. The directory of members provides details of organisations offering certification services for ISO 27001.

Axiomtek

Axiomtek

Axiomtek is a leading design and manufacturing company in the industrial computer and embedded field.

Open Source Security Foundation (OpenSSF)

Open Source Security Foundation (OpenSSF)

OpenSSF is committed to collaboration and working both upstream and with existing communities to advance open source security for all.

NetAlly

NetAlly

NetAlly network test solutions help engineers and technicians better deploy, manage, maintain, and secure today’s complex wired and wireless networks.

Interlynk

Interlynk

Interlynk's #SBOM and # VEX-powered platform automates and continuously monitors first-party and vendor software supply chains and helps meet #FDA, #CRA, #GSA, and #DoD compliance obligations.

CyberAntix

CyberAntix

CyberAntix offers Premium CyberSecurity for your business using an advanced Security Operations Centre technology and process platform reinforced by a steadfast and expert SOC team.

C5 Technology

C5 Technology

C5 Technology specialises in the provision of networking, security, and infrastructure services to enterprises and government agencies.