The past 18 months has been dominated by news of the global Covid-19 pandemic, and some businesses have struggled to find ways of securely supporting employees working from home. As with any global crisis, there are always a number of cyber-criminals trying to jump on the back of it, and Covid-19 is no exception to that. The overwhelming amount of media coverage surrounding the coronavirus has created a new danger — phishing attacks looking to exploit fears about the virus.
So how do these phishing attacks work?
To put it simply; cybercriminals send emails claiming to be from legitimate organisations with information about the coronavirus, offering help and guidance. The emails might ask you to open an attachment to see the latest statistics, or invite you to get your vaccine. If you choose to click on the attachment or embedded link, you’re likely to download malware onto your device that could put you and your business in danger.
The malicious software could allow cybercriminals to take control of your computer, log your keystrokes, access your camera, search history or even access your personal information and financial data, which could lead to identity theft. There’s nothing new about this approach, just a new spin by cyber-criminals using coronavirus and capitalising on panic and disinformation.
How do I spot a coronavirus phishing email?
NHS Vaccine appointments – Some people have reported receiving emails from the NHS to book their vaccine appointments for a fee. Clicking the link takes you to a professional looking copy of the NHS website, however it asks for banking information to be able to book an appointment. The NHS and the government have warned against these emails, emphasising that they will never ask for a payment.
CDC alerts – Cybercriminals have sent phishing emails designed to look like they’re from the U.S. Centers for Disease Control. The email may falsely claim to link to a list of coronavirus cases in your area. “You are immediately advised to go through the cases above for safety hazard,” the text of one phishing email reads.
Workplace policy emails – Cybercriminals have targeted employees’ workplace email accounts. One phishing email begins, “All, Due to the coronavirus outbreak, [company name] is actively taking safety precautions by instituting a Communicable Disease Management Policy.” If you click on the fake company policy, you’ll download malicious software.
Health advice emails – Phishers have sent emails that look as if they offer medical advice to help protect you against the coronavirus. The emails might claim to be from medical experts near Wuhan, China, where the outbreak first began. “Use the link below to download our recommended Safety Measures.”
Tips for recognising and avoiding phishing emails
Here are some ways to recognise and the kinds of phishing emails mentioned above.
- Beware of online requests for personal information. A coronavirus-themed email that seeks personal information like your national insurance number or login information is a phishing scam. Never respond to the email with your personal data.
- Check the email address or link. You can inspect a link by hovering your mouse button over the URL to see where it leads. Sometimes, it’s obvious the web address is not legitimate. But keep in mind phishers can create links that closely resemble legitimate addresses. Delete the email.
- Look for generic greetings. Phishing emails are unlikely to use your name. Greetings like “Dear sir or madam” signal an email is not legitimate.
- Avoid emails that insist you act now. Cyber criminals often try to create a sense of urgency; their goal is to get you to click on a link and provide personal information as soon as possible. Instead, delete the message.
- Keep an eye out for spelling and grammatical mistakes. If an email includes spelling, punctuation, and grammar errors, it’s likely a sign you’ve received a phishing email. Delete it immediately.
Online scams that are tailored to major news events have been around for decades. With the coronavirus commanding an almost unprecedented amount of coverage around the world, these latest campaigns have been nothing short of a flurry of attacks that show no signs of slowing down.
