A phishing campaign is using convincingly spoofed offers for COVID-19 vaccination sign-ups, according to Tom Allen at Computing. As vaccines are now being distributed around the world, cybercriminals have shifted their phishing lures to take advantage of peoples’ desire to receive the vaccines.
Allen received an email that purported to come from The UK’s National Health Service (NHS), which stated, “The NHS is performing selections for coronavirus vaccination on the basis of family genetics and medical history. You have been selected to receive a coronavirus vaccination.” The message displayed proper grammar and spelling, as well as correct information about the vaccine itself. The email asked recipients to click on a link that said “NHS – Accept Invitation.”
Allen notes that, unlike many phishing emails, this one didn’t convey a sense of urgency. People who are trained to watch out for phishing emails with urgent deadlines and frightening scenarios could be made to lower their guard by this email’s matter-of-fact tone.
“Note the hands-off approach to booking a vaccine,” Allen writes. “There’s no pressure on the recipient, other than the 12-hour reply requirement - nothing to make you think the sender is anything but an automated service, leaving the choice of whether to click the link wholly in your hands. It's a significant departure from more common approaches to phishing emails, where the attacker will try everything in their power to get you to follow through.”
Allen says he nearly fell for the ruse, but he knew that he wasn’t due to receive a vaccine until February or March. He also noticed that, while the sender’s name was “noreply@nhs.gov.uk,” the actual sender’s address was “info@itomedhp[.]jp.”
In this case the soft-sell is more effective than the social engineers’ usual hard-sell, act-now pitch. This scam would have been even harder to detect if the recipient had been on a mobile device and was expecting to receive an invitation for a vaccination. New-school security awareness training can help your employees recognize phishing attacks by teaching them to be wary of unsolicited offers, even if they’re plausible.
Computing has the story.
Here's how it works:
