Coronavirus-Themed Phishing Fears Largely Overblown, Researchers Say

As COVID-19-themed spam rises, phishing—not so much. An analysis of newly registered domains finds that only 2.4% are actually phishing sites aiming to steal credentials.

While many security firms have warned that massive spam campaigns employing coronavirus-themed messages in an attempt to fool potential victims into parting with their credentials, the incidence of COVID-19-specific phishing attacks is no higher than before the pandemic, according to a new report.
Lastline researchers found that 84% of newly registered domains did not have any content, while about 14% of domains led to a questionable landing page — or gray zone — that tried to sell counterfeit goods or questionable coronavirus-related products. Only 2.4% of sites were actually phishing for specific information from the victims, and only four campaigns, consisting of less than 800 URLs, were specifically designed to take advantage of the coronavirus pandemic.
While cybercriminals are trying to cash in on peoples coronavirus concerns, the specific use of coronavirus-specific information are lures to convince people to click on links and attempts at fraud or the sale of counterfeit goods, says Roman Vasilenko, engineering manager of Lastlines Anti-Malware Group.
The volume of attacks using the topic of COVID-19 did not change, he says. Overall, phishing grew very considerably in March and then in April — it has basically doubled according to our numbers. But the targets of those landing pages — Bank of America and Chase Bank are the top ones — remain the same as before.
Domain Spike
Over the past two months, concerns have grown that cyberattackers were
turning peoples fear of the coronavirus into cybercriminal attacks
. Coronavirus-related domain registrations skyrocketed, topping 2,000 domains a day in late March,
according to intellectual-property protection firm MarkMonitor
, which noted that the total number of pandemic-related domain registrations was set to pass 100,000 by late April. The same month, Google announced that
18 million of the approximately 100 million spam messages
that the company blocks were related to coronavirus or the pandemic.
In mid-April, three US senators
wrote to domain registers
to request information on their plans to combat pandemic-inspired fraud.
Yet,
Lastlines analysis
showed that, while spam operators and domain speculators had taken to pandemic themes, only 2.4% of newly registered domains with a COVID theme were actually phishing sites that tried to fool visitors into parting with their credentials.
[T]o our surprise, many of these phishing domains carry the same content that we have been aware of long before the pandemic, Lastline wrote in the analysis. Very few of them lead to novel phishing campaigns that exploit coronavirus fears.
Lastline collected information on newly registered domains from the feeds of three different organizations: the Cyberthreat Coalition, PhishLabs, and the Cybersecurity and Infrastructure Security Agency (CISA). To analyze the newly registered domains, Lastline used image analysis to cluster the large number of landing pages that included a COVID-19 keyword into similar looking clusters. The recognition algorithm looked for specific elements — such as username and password fields — to identify those pages that attempted to collect credentials.
In analyzing the similar-looking clusters, Lastline then grouped the phishing sites into three groups: Sites that used pre-pandemic content with some updates to match the current sites, such as banks posting disclaimers or offers to help with financial distress; sites that used a COVID-19 related keyword to lure users but did not change the content; and sites that specifically used the pandemic to attract and convince users to give up specific information.
Phishing e-mails are very related to what is happening to the world, says Vasilenko. But phishing websites are focused on a goal.
The company discovered nearly 300,000 phishing URLs using the newly registered domains as part of a phishing attack. Removing campaigns that existed prior to the pandemic left only 795 URLs grouped in four campaigns, which targeted the World Health Organization, the Canada Revenue Agency, Netflix, and an electronic money transfer system.
The problem for cybercriminals is that while global news events such as the coronavirus pandemic attract attention and thus
are the basis for a good lure
, they do not often provide a good platform to fool victims into parting with information.
To gather credentials, the actors need to design and build at site to look like the target, often a bank, Vasilenko says. That requirement does not change with COVID. Attackers still want to steal exactly the same thing.
Overall, pandemic-related phishing activity seemed to peak in the second week of April and has largely subsided, according to Lastlines analysis.
Related Content
Latest Security News & Commentary about COVID-19
Attackers Adapt Techniques to Pandemic Reality
Fake Microsoft Teams Emails Phish for Credentials
COVID-Themed Phishing Messages Fill Phishing Filters on Gmail
After Adopting COVID-19 Lures, Sophisticated Groups Target Remote Workers

Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that really  bad day in cybersecurity. Click for
more information and to register
.

Last News
▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Coronavirus-Themed Phishing Fears Largely Overblown, Researchers Say