Fraudulent emails ask for sensitive personal data and include malicious links and attachments
The World Health Organization (WHO) has warned that it is being impersonated by cybercriminals in a phishing campaign that exploits anxieties surrounding the latest coronavirus outbreak.
In a recently posted security alert, the WHO said the offending emails ask recipients to hand over sensitive information like usernames or passwords, and include malicious links and attachments that trigger the installation of malware.
“Criminals are disguising themselves as WHO to steal money or sensitive information,” the alert reads. “If you are contacted by a person or organization that appears to be from WHO, verify their authenticity before responding.”
Email recipients can verify the sender’s authenticity, as well as report scams, by contacting the WHO directly, the organization said.
The WHO, which declared the outbreak of the unique coronavirus pathogen COVID-19 a global public health emergency on January 30, also advises recipients to check the sender’s email address.
Legitimate emails from WHO employees always follow the ‘[email protected]’ format, while web links will always start with ‘https://www.who.int’, the Geneva-based health agency confirmed.
Disaster fraud
On February 5, security researchers from Sophos flagged fraudulent emails purporting to come from the WHO that asked users to download measures for avoiding the now notorious coronavirus strain.
Kaspersky has discovered a similar campaign that hijacked the US Centers for Disease Control and Prevention’s identity in an attempt to trick people into clicking a malicious link.
Unscrupulous cybercrooks have also used COVID-19, which has now claimed more than 1,800 lives, to spread Emotet malware in Japan.
Although the WHO’s latest warning may go some way to helping internet users be on their guard, this latest campaign is by no means an isolated incident.
Major global crises, such as health scares, natural disasters or terror attacks, have long been a favored target for so-called ‘disaster fraud’ phishing campaigns, which exploit fear, confusion, and, in the case of phony donation requests, compassion.
Kelvin Murray, senior threat researcher at Webroot, said such global crises helped to fuel a 640% rise in phishing URLs reported in the 2020 Webroot Threat Report, which was released today.
“It’s unsurprising that the World Health Organization is currently being impersonated at scale, as scams based off current news are always going to be more effective, especially when tied to emotive topics in the public interest,” he told The Daily Swig.
“Whereas in the past we have seen fake stories about Conor McGregor or Elon Musk driving click-through to malicious twitter links, today we see coronavirus emails driving click-through to threats such as Emotet.”
Javvad Malik, security awareness advocate at security training provider KnowBe4, added: “We’ve seen several variations of phishing emails under the guise of warnings, to charitable donations, to flight and travel updates.
“Many of these phishing emails don’t contain any malicious attachments which can be scanned, so they have a high success rate in reaching the user’s desktop.”
Mitigation measures
Murray recommends that risk mitigation measures should include email filtering, antivirus protection, strong password policies, security awareness training, and backing up data to a secure location.
Both Facebook and Twitter have issued statements explaining their own measures for combating the spread of misinformation and scams that exploit the coronavirus crisis.
The WHO is also urging the public to not be rushed into handing out personal information, and to be suspicious of requests for usernames and passwords in order to access what should be freely available information.
Scammers can request such information not just through emails but websites, phone calls, text messages, and even fax messages too, the alert warns.
Anyone who believes they may have given sensitive data to cybercriminals are advised to immediately update their relevant login credentials.
The Daily Swig has contacted the WHO for further details.
RELATED Black Hat Asia 2020 postponed due to coronavirus epidemic
