The message is obviously not from the CDC and at the time of this writing, there are very very few local cases in America. Let's hope it stays that way.
Here is a sample of the message that is being used. Your users can report this as phishing through the free Phishing Alert Button, delete the message if they receive it, or use your existing reporting mechanisms. There will be many other social engineering attacks using this same scare. This is a screen shot of the real attack:
We also strongly recommend you send them a simulated phishing template to—pun intended—inoculate them against attacks like this. As an exception (we normally do not show these templates) but here is what your ready-to-send campaign looks like.
I would send your employees, friends and family something like the following. Feel free to copy/paste/edit.
"The worldwide spread of the new Coronavirus is being used by bad guys to scare people into clicking on links, open malicious attachments, or give out confidential information. Be careful with anything related to the Coronavirus: emails, attachments, any social media, texts on your phone, anything. Look out for topics like:
- Check updated Coronavirus map in your city
- Coronavirus Infection warning from local school district
- CDC or World Health Organization emails or social media Coronavirus messaging
- Keeping your children safe from Coronavirus
- You might even get a scam phone call to raise funds for "victims".
There will be a number of scams related to this, so please remember to Think Before You Click!
For KnowBe4 Customers, you can find the above simulated phishing template in the Current Events category. I suggest you send to your employees and friends / family more or less immediately.
Let's stay safe out there.
Warm regards,
Stu Sjouwerman
Founder and CEO, KnowBe4, Inc.