Why? Well, thanks to the COVID-19 pandemic, people are spending more time online than ever. That leaves a perfect opportunity for hackers to take advantage of people and attack their personal data and finances. Tap or click here to see just how creative these scammers are getting. As phishing schemes continue to spike, security researchers around the world are doggedly tracking new cases and figuring out how they operate. And now, two new phishing schemes have been detected that you need to watch out for.
If the COVID-19 tests are ‘mandatory,’ opening the email is optional
According to a new blog post from security researchers at GreatHorn, a dangerous phishing scheme has been discovered attacking inboxes around the country, honing in on one common fear: COVID-19. It’s an email that comes with the subject line “Mandatory Covid-19 Assessment for Employees.” If you were to look at the message, you might immediately assume it’s from your boss or an associate of your employer due to its professional letterhead and official appearance. But as it turns out, it links to the same malicious domain as other common phishing emails. If you make the mistake of clicking the link, you’re urged to enter your “contact information” to set up the tests. Once you hit “Submit,” you data is immediately captured by the cybercriminals behind the email, which can lead to compromised accounts or worse. This isn’t the first time we’ve seen scammers masquerade as other entities like businesses or government agencies, but it’s one of the clearest examples of how widespread the issue has become in recent weeks. Tap or click here to see even more impostor scams that are circulating right now.
An old favorite: Email ransomware is back, too
Malicious links aren’t the only popular method being used by hackers. Actual ransomware, once relegated to malicious downloads and websites, has begun to circulate in email form once again in recent weeks. According to reports from researchers at ProofPoint, several families of ransomware products are now being smuggled into malicious emails disguised as ordinary attachments. Just like before, the email itself tricks you into downloading the attachment using loaded language about COVID-19 testing and personal messages from friends and family. Once the attachment is downloaded, the ransomware springs to life and demands a bitcoin payment in exchange for access to your files. Unlike other, higher-profile ransomware cases, the demands tend to stick to the sub-$1,000 range, which makes it even more likely that victims will pay up.
What’s the best way to stay safe from this malware wave?
Both examples listed above can be critically dangerous to your security and privacy, and may end up costing you some money on top of your pain and suffering. But they’re easy to avoid if you know what to look for. In the case of the ransomware, the researchers from ProofPoint were able to compile many of the possible subject lines circulating with the malicious emails. If any emails with these subject lines make their way to your inbox, delete them immediately without opening them.
Do you know him?”“Our old picture”“Photo for you”“Do you like my photo?”“Is this you?”“Your new photo?”“I like this photo”Your COVID19 results are ready / 85108Your COVID19 results are ready # 85513Your COVID_19 results # 99846View your COVID19 result # 99803human immunodeficiency virus analysis # 93545COVID19 virus test result / 61043COVID19 virus result / 64745COVID19 virus analysis # 83273Check your COVID_19 test # 65619Your COVID_19 Results No 80420
Beyond knowing the subject matter, though, avoiding a phishing or ransomware email is easy. First and foremost, don’t open emails from unfamiliar senders. But if you see an email from somone you know with any of the above email subjects, there’s still a chance that person’s account got hijacked and is being used to spread malware. That said, just opening an email isn’t enough to trigger any malicious downloads, but clicking on links sure will. As with any unusual or unfamiliar emails, if you see a link or an option to download an attachment, check with the person who sent it to you (if you know them) by phone or text to make sure it’s legitimate. Alternatively, if you receive a link you’re instructed to visit, you can hover your mouse over it rather than click. This will give you a preview of the URL, which will tell you whether or not it’s real. If you hover over the mouse and see the following link, it’s related to the COVID-19 test phishing campaign: https:/\afzan.co/wp-content/themes/1/1. (DO NOT CLICK THIS) It’s unfortunate we have to rely on ourselves to stay safe online, but at the very least, we can bulk up our efforts with some solid cybersecurity software to make our jobs easier. Tap or click here to see our favorite free online virus scanners.
