As the spread of novel coronavirus continues to make headlines globally and events such as South by Southwest are canceled, scammers are taking advantage of the news through targeted phishing emails and scam websites.

Researchers at Check Point Software Technologies Inc. said Thursday they have observed a noticeable number of new websites registered with domain names related to the virus, officially called COVID-19. More than 4,000 coronavirus-related domains were found to have been registered globally since the end of December, with 3% found to be malicious and an additional 5% suspicious.

In one example, a Russian website offers to sell “the best and fastest test for Coronavirus detection at the fantastic price of 19,000 Russian rubles (about US$300).”

Scammers are also using phishing emails to target potential victims who are interested in coronavirus news. The Wall Street Journal reported last week that the number of malicious emails mentioning the virus has increased significantly since the end of January.

Some examples of fake emails include scammers pretending to be the World Health Organization and the U.S. Centers for Disease Control and Prevention. The emails typically include an attached document that readers are encouraged to open to obtain important information on necessary precautions against catching the virus.

Suffice it to say, the attachments are malicious. In one example, the attachment resulted in users being infected with the Ostap Trojan-Downloader, a Trickbot variant.

“Recently, the number of phishing emails purporting to be from companies’ trusted business partners and public organizations is increasing,” Orion Cassetto, director of product marketing at security management platform provider Exabeam Inc., told SiliconANGLE. “Phishing is essentially a form of social engineering. In this case, cybercriminals are utilizing the world’s alertness around COVID-19 to entice people to click on malevolent links and/or download attachments.”

Phishing is just the entry point, Cassetto explained. “It can lead to malware infection, lateral movement on the network, account takeover, identify theft and more,” he said. “In short, if any email looks even mildly suspicious, employees shouldn’t interact. It’s essential to validate the message and content directly with the company or website the email purports to be from, instead of interacting with the email sender.”

Image: Pixabay