MailGuard has intercepted a series of malicious emails faking COVID-19 financial relief.
Cybersecurity company Mailguard has warned the public that emails with titles such as “See Covid19 relief payment that has been paid” or “BLOCKCHAIN: See Payment Approval for Covid19 Donation”, are likely from compromised email accounts.
Some of these emails contain a domain that appears to be from a legal firm, and other examples are from similarly trustworthy sources such as a Christian school (…@Holyfamilyschool…).
The “To:” field is an email address beginning with “noreply” and the example below uses the domain “@covid19”.
The email informs the recipient their account has been credited “for the Covid_19 donation” and that the payment confirmation page is attached. A link to this page is provided, titled “Promocode_fe33e”, along with a “PDF” image.
Unsuspecting recipients who click on the link to view the page are led, not to a PDF file, but an HTML page hosted on “getcloudapp.com” with its background blurred.
A message appears at the front of this page, titled “Account Payable Shared A File With You”. A file labelled ‘Remittance Advice” is included, along with a link to download the file.
[Refer to Screenshot: Covid_19_Scam_200420_HTML page]
Clicking on the button titled “Open” currently leads to an error page.
This is a particularly sinister scam as cybercriminals are attempting to exploit users who may be suffering from financial difficulties as a result of the economic uncertainty caused by the COVID-19.
According to Mailguard scammers are aware any individuals and businesses are currently in desperate need of economic assistance.
“These attackers are capitalising on this hardship to steal even more from those who are already suffering,” stated Mailguard.
Here are some ways this email scam has attempted to exploit users:
• The use of a subject line like “See COVID19 relief payment that has been paid”. This creates intrigue among recipients, or even excitement among those who are actually expecting financial assistance. This may motivate them to click on the link without pausing to check for the email’s legitimacy.
• The sender address implies the email is from a legal firm, Christian school or similar respected institutions. This isn’t unexpected and is plausible that a notice of this nature may be sent with a COVID-19 relief notification, thereby not raising any alarm bells.
Despite these techniques, eagle-eyed recipients of this email would be able to spot several red flags that point to the email being a fraud. These include the fact that the email doesn’t address the recipient directly, and that the link included in the email doesn’t actually open a PDF, as implied. Several grammatical errors like ‘in few working days’ and spelling errors (“Covid_19”) are also red flags that this email is, in fact, not legitimate.
As a precaution, MailGuard urges CIOs to warn their users not to click links within emails that:
• Are not addressed to you by name.
• Appear to be from a legitimate company but use poor English or omit personal details that a legitimate sender would include.
• Are from businesses that you were not expecting to hear from.
• Take you to a landing page or website that is not the legitimate URL of the company the email is purporting to be sent from.
Tags: COVID-19cyber criminalsCybersecurityemailsfraudlegalPandemic
