sb-au logo
Story image

MailGuard intercepts sinister cybercrime emails notifying users of COVID-19 “relief payment”

Cyber criminals have sent out a series of malicious emails attempting to manipulate users suffering from financial turmoil and difficulties triggered by the COVID-19 crisis.

According MailGuard, which intercepted the emails, the emails have similar titles such as See Covid19 relief payment that has been paid or BLOCKCHAIN: See Payment Approval for Covid19 Donation. The sender addresses are likely to be from compromised email accounts, with some from what appear to be a legal firm or similarly trustworthy sources such as a Christian school.
 
The email informs the recipient that their account has been credited for the Covid_19 donation and that the payment confirmation page is attached. A link to this page is provided, titled Promocode_fe33e, along with a PDF image.

Unsuspecting recipients who click on the link to view the page are led, not to a PDF file, but an HTML page hosted on getcloudapp.com with its background blurred.

A message appears at the front of this page, titled Account Payable Shared A File With You. A file labelled Remittance Advice is included, along with a link to download the file.

Clicking on the button titled Open currently leads to an error page.

"This is a particularly sinister scam as cybercriminals are attempting to exploit users who may be suffering from financial difficulties as a result of the economic uncertainty caused by the COVID-19, MailGuard says.

"Scammers are well-aware that many individuals and businesses are currently in desperate need of economic assistance. Cruelly, these attackers are capitalising on this hardship to steal even more from those who are already suffering."

Ways this email scam has attempted to exploit users, according to MailGuard:

  • The use of a subject line like See COVID19 relief payment that has been paid. This creates intrigue among recipients, or even excitement among those who are actually expecting financial assistance. This may motivate them to click on the link without pausing to check for the emails legitimacy.
  • The sender address implies the email is from a legal firm, Christian school or similar respected institutions. This isnt unexpected and is plausible that a notice of this nature may be sent with a COVID-19 relief notification, thereby not raising any alarm bells.

Despite these techniques, eagle-eyed recipients of this email would be able to spot several red flags that point to the email being a fraud, MailGuard says. These include the fact that the email does not address the recipient directly, and that the link included in the email does not actually open a PDF, as implied. Several grammatical errors like in few working days and spelling errors (Covid_19) are also red flags that this email is, in fact, not legitimate.

"The practice of launching cyberattacks that are centred around ongoing trends isn't anything new. Cybercriminals have long employed these tactics to take advantage of any disruptions and vulnerabilities in the hope that users uncertainties and fear around new changes will get better of them and they will not pause to check for the legitimacy of these emails," says MailGuard.

"Coronavirus-themed cyberattacks are designed to play with human psychology and emotions, like this one we intercepted a few weeks ago. As such, we strongly advise being extra vigilant when you receive emails such as these and lookout for any tell-tale signs that might be suspicious."

As a precaution, MailGuard urges you not to click links within emails that:

  • Are not addressed to you by name.
  • Appear to be from a legitimate company but use poor English or omit personal details that a legitimate sender would include.
  • Are from businesses that you were not expecting to hear from.
  • Take you to a landing page or website that is not the legitimate URL of the company the email is purporting to be sent from. 
Story image
Video: 10 Minute IT Jams - SonicWall VP on the benefits of Boundless Cybersecurity
Today's interviewee will discuss the ins and outs of the company's Boundless Cybersecurity solution and how it can help APAC organisations adjust to the new normal, as well as explaining the 'cybersecurity business gap'.More
Story image
How a vantage point sees threats before they impact
When the focus has been on adversaries that develop increasingly complex and sophisticated attacks, tried and true techniques such as compromised credentials continue to be amongst the most potent weapons.More
Story image
Video: 10 Minute IT Jams - Vectra AI exec discusses cybersecurity for Office 365
In Techday's second IT Jam with Vectra AI, we speak again with its head of security engineering Chris Fisher, who discusses the organisational impact of security breaches within Microsoft O365, why these attacks are on the rise, and what steps organisations should take to protect employees from attacks.More
Story image
rhipe adds Octopus licensing solutions to distie portfolio
The addition of Octopus Cloud provides rhipe partners with licensing solutions and management processes to support cloud transformation initiatives.More
Story image
Fortinet named Leader in Gartner Magic Quadrant for Network Firewalls
It is 11th time the company has been recognised in the annual report.More
Story image
Ivanti extends ESM automation capabilities with latest additions
Ivanti has made additions to its Enterprise Service Management (ESM) portfolio, with greater automation capabilities between service management and SecOps. More