So the scammers are taking advantage of the COVID-19 pandemic. But, of course.
As reported on Sky News, experts from the National Cyber Security Centre (NCSC) have said that a range of attacks are being conducted by cyber criminals to make money out of exploiting people’s fears over COVID-19.
The article states that fake emails posing as communications from health authorities are being sent with links claiming to provide important updates, which when clicked instead lead to devices being infected with malware. The NCSC warned: “Individuals in the UK have been targeted by these coronavirus-themed phishing emails, with infected attachments containing fictitious ‘safety measures’.”
The US Centre for Disease Control and the World Health Organisation have also been impersonated by the fraudsters.
The cybercriminals create domain names similar to these organisations’ real web addresses in order to dupe email recipients and “request passwords and even bitcoin donations to fund a fake vaccine”, says the NCSC.
Coronavirus: Using masks to lure you in
According to Sky News, criminals are also taking advantage of the outbreak on dark net marketplaces, where normal listings for drugs and hacking tools are being joined by offers for surgical face masks.
Away from the dark web, hundreds of websites have been set-up within the past few weeks offering heavily discounted face masks.
But, as risk firm Digital Shadows told Sky News, there is a huge risk that these products are counterfeit, and in some cases the masks potentially don’t even exist at all – and once enough consumers have handed over their money, the website will simply disappear.
The scam to be wary of: “Coronavirus awareness”
Cyber criminal gangs are also targeting healthcare professionals with phishing emails about “coronavirus awareness” – part of a wave of scams capitalising on the pandemic.
Sky News has seen a copy of an email scam sent to a number of healthcare organisations that pretends to be from each firm’s internal IT team.
The email – which has the subject “ALL STAFF: CORONA VIRUS AWARENESS” – tells employees that “the institution is currently organising a seminar for all staff to talk about this deadly virus”, asking them to click on a link to register.
The link takes anyone clicking on it to a third-party website disguised as an Outlook web app. Anyone who fills in that form ends up giving their details to the hackers.
Paul Chichester, the NCSC’s director of operations, said: “We know that cyber criminals are opportunistic and will look to exploit people’s fears, and this has undoubtedly been the case with the coronavirus outbreak. Our advice to the public is to follow our guidance, which includes everything from password advice to spotting suspect emails.”
Playing on fear
Jake Moore, Cybersecurity Specialist at ESET, says that, “The spread of fear is just as contagious as COVID-19 and people are falling for these scams in panic mode. Cyber criminals are relying more on social engineering, which is the practice of deceiving or manipulating someone. Right now this tactic is proving very popular; people feel they have limited time to research the background and validation of sites. Panic is a psychological feeling that threat actors use widely, especially when there is a pandemic.
I’m also seeing a huge increase in texting scams. I’ve seen employees targeted with texts which are supposedly from their boss, requesting that they send Amazon vouchers to their business partners to apologise for business inconvenience. Employees need to verify these requests by phoning their management on the number they know to be correct before any financial transactional is made.”
Remote working tools tricks
Ed Bishop, Chief Technology Officer at Tessian, advises, “As more employees are asked to work from home, people need to be even more vigilant when it comes to phishing attacks. Hackers love emergencies and times of uncertainty, because people are scared, distracted, and vulnerable. This makes them ideal targets.
“During this time, staff need to be aware that hackers will impersonate trusted individuals and brands to trick people into steal money, harvest credentials, or install malware on their computers. Bad actors may impersonate senior executives such as the CEO or the CFO, saying ‘as we’re away from the office, please send me your personal phone number as I need you to do something for me.’ In this case, I urge people to contact the person who requested you to do something – via an internal channel like Slack or an SMS – to confirm it was them.
“Similarly, as organisations rely on remote-working tools, hackers may also pose as popular web conferencing applications and trick staff into clicking links that will ‘activate their web conferencing accounts’. Be less trusting of any email asking you to take an action. Look beyond the branding of the email or the display name and examine the full email address of the sender, and any URL, carefully.