You're Fired (Not Really, Just Clicked on a Phishing Email)

The operators of the BazarLoader malware are using phishing emails that inform people they’ve been terminated from their jobs, according to Linn Freedman, a partner at Robinson & Cole LLP, writing for the National Law Review. These types of attacks are particularly effective (and cruel) during the COVID-19 pandemic, since many people are worried about losing their jobs.

“The scheme works like this: an email is sent to an employee from an authority in the Human Relations department stating that the individual has been terminated,” Freedman explains. “An attachment to the email provides further information about the termination and the severance payout, which appears to be on Google Docs. When the victim clicks on the attachment, they are directed to a fake Google Docs page and told to click on another link. When they click on that link, they are directed to a URL to download a file.”

Freedman writes that many employees would be tempted to open such an email, even if they think it’s unusual or suspicious.

“Just as ending a relationship with an email or a text message is bad form, employers don’t usually terminate employees with an email,” Freedman says. “Nonetheless, since a message that appears to address a termination is so drastic and final, it is hard to resist opening it, if only to see if your severance is mentioned in the email.”

Freedman offers the following advice for users:

• “Be wary of termination emails—if you receive one, it is probably fake.
• “If you really are terminated, Human Resources will get in touch with you one way or the other.
• “Continue to be vigilant about phishing schemes and spoofing campaigns using executives’ identities.
• “Think twice before you click or say ‘I agree.’
• “Don’t open any attachments or click on any links that you are not expecting.
• “Pick up the phone to confirm suspicious emails, links or attachments.”

Only one employee has to fall for one of these attacks for an attacker to gain a foothold on your network. New-school security awareness training can give your organization an essential layer of defense by enabling your employees to avoid falling for social engineering attacks designed to play on their emotions.

The National Law Review has the story.