Cybersecurity is not immune to COVID-19

The Coronavirus outbreak has made headlines all around the world as governments race to contain the crisis. But if there’s one group that’s been working overtime, it’s scammers and cyber attackers. One of the UK's intelligence agencies just made a special announcement to warn the public about criminals who are targeting users with a range of attacks to make money out of exploiting people's fears over COVID-19.

The most common type of scam is a fake email posing as a message from health authorities. Internationally, organisations like the US Centre for Disease Control and the World Health Organisation have been impersonated by cybercriminals. These emails contain links and attachments which, if clicked, infect a user’s devices with malware. We’ve already written about how many of these Coronavirus emails contain the dangerous malware emotet, and the damage it can do. 

More sophisticated attackers create domain names similar to health organisations’ real web addresses in order to fool email recipients. They may request passwords, sensitive info and even bitcoin donations to fund a fake vaccine.

But these cyber gangs aren’t just limiting themselves to ordinary users. Retail, shipping, transport and even health organisations are also being targeted with phishing emails. Disguised as "coronavirus awareness" messages, these emails pretend to be from the organisation’s internal IT team with subjects like “Attention all staff: Coronavirus Awareness”, and talk about organising seminars or internal meetings for staff on the subject. The sneaky part is how they invite employees to click on a link too ‘register’ or sign up for the event.

In reality, the link takes the user to a third-party website disguised as a convincing replica of the Outlook web app. Anyone who fills in that form ends up giving their details, like logins and passwords, to the attackers. If an unsuspecting employee does fall for the scam, the attackers can steal documents, encrypt company data and carry out devastating ransomware and blackwhaling attacks.

Enterprising criminals are also cashing in on the COVID-19 panic by creating fake websites claiming to sell surgical face masks. Masks are already sold out in many local stores and even online sellers like Amazon, which is why customers are turning to questionable online stores offering discounted surgical masks. But buying from a random online store is never a good idea. In some cases, customers have received counterfeit or even used masks, and in many more cases, the masks don’t even exist at all. Once customers hand over their money and banking info, the attackers make off with their data and the website simply disappears.

According to the UK's National Fraud Intelligence Bureau, people in the UK have been scammed out of more than £800,000 by attempting to buy masks from fake sellers. Face masks may be the first counterfeit product to pop up, but it likely won’t be the last.

Fortunately, protecting yourself and your organisation from scams doesn’t have to be overly technical. Just keep an eye out for any suspicious emails with links or attachments, never share your data online (or even via SMS!) unless you’re absolutely sure who you’re sharing it with, and don’t let the Coronavirus panic override your better judgment. Here are some steps you can take to inoculate yourself and your team from Human Error, which will go a long way in keeping your cyber defences strong and healthy.