The National Health Service (NHS) in the UK recently sent a warning that cybercriminals are using social engineering tactics to target people wanting a COVID-19 vaccine email that is indeed, a phishing attack.
While emotions about the pandemic are still running high, it's important that your organisation stays cautious of the different types of attacks. Akamai gives a breakdown of the different types of COVID-19 attacks and the different warning signs your organization should watch out for:
Shopping
Since the initial lockdown, online shopping has significantly increased. The Internet is also prime hunting ground for cybercriminals. The example below shows how cybercriminals developed and sold COVID-19 related scam sites earlier in the pandemic.
Source: Akamai
Credential Phishing
Throughout 2020, cybercriminals used COVID-19 to their advantage in almost all of their phishing campaigns. The campaigns use COVID-19 spread and safety information, vaccine development, vaccine testing, and lockdown information to target vulnerable victims. This example below shows a phishing kit that shows various usernames and passwords for multiple email services that would require your email credentials:
Source: Akamai
Vaccines
Now that the vaccine is available, cybercriminals have now focused all of their attention on targeting victims with vaccine phishing emails. The example below shows the most recent phishing landing page:
Source: Akamai
There are quite a few problems if you really look into this example, with grammatical mistakes. But if you weren't paying enough attention, then you would be easily fooled. "The NHS is performing selections for coronavirus vaccination on the basis of family genetics and medical history. You have been selected to receive a coronavirus vaccination," the landing page explains.
Unfortunately, the pandemic and phishing attacks are not going away anytime soon. Make sure you visit the NHS website for any updates on any scams. Make sure you are frequently testing your users and utilise new-school security awareness training to ensure your users are prepared in their day-to-day job functions.
Akamai has the full story.
