Google LLC today warned that it’s seeing a big increase in the number of phishing, spam and malware emails being sent to businesses and their workers amid the coronavirus pandemic, which has forced millions of employees across the world to work from home.

A blog post written by Gmail Security product manager Neil Kumaran and G Suite and Google Cloud Platform security lead Sam Lugani highlighted a number of new tactics scammers are employing to try and trick workers into giving up confidential information, such as their user logins and password details.

Many of the phishing emails try to take advantage of the confusion caused by the COVID-19 outbreak by impersonating organizations such as the World Health Organization.

In one example email that was purportedly sent from the WHO, attackers try to solicit fraudulent donations via bitcoin payments:

Other examples show how attackers are using emails to try and distribute downloadable files that can install backdoors into users’ computer systems. Attackers are also trying to target employees working from home with emails that appear to come from the head office, while others are attempting to capitalize on government stimulus packages by imitating government institutions, Google said.

“Phishing is still one of the most effective methods that attackers use to compromise accounts and gain access to company data and resources,” Kumaran and Lugani wrote. “In fact, bad actors are creating new attacks and scams every day that attempt to take advantage of the fear and uncertainty surrounding the pandemic.”

Google is of course, doing its bit to prevent such emails from ever being seen by their intended recipients. The built-in spam protections in Gmail block the vast majority of phishing and malware emails, but many continue to slip through the net.

“Every day, Gmail blocks more than 100 million phishing emails,” Kumaran and Lugani said. “During the last week, we saw 18 million daily malware and phishing emails related to COVID-19. This is in addition to more than 240 million COVID-related daily spam messages. Our ML models have evolved to understand and filter these threats, and we continue to block more than 99.9% of spam, phishing, and malware from reaching our users.”

Google has also issued a number of guidelines for workers that should help to minimize their chances of falling victim to a malicious email. For example, it recommends that all Gmail users complete a Security Checkup to boost their account security. It also advises users to avoid downloading files from any email address they don’t recognize, and instead use the preview function in Gmail to check them first.

Other steps include checking the integrity of a URL before entering any login credentials and reporting any phishing emails that users spot. Google also recommends users to consider enrolling in its Advanced Protection Program, noting that it hasn’t yet seen anyone that participates in the program fall victim to a phishing email.

Google further advises company administrators to consider looking at the recommended defenses on its advanced phishing and malware protection page.

Image: Tumisu/Pixabay