While it is unfortunate and tasteless in the light of COVID-19’s impact on the world, we are seeing that criminals are using the pandemic as an opportunity to exploit peoples goodwill and need for information or help.

Our wider cyber security community is reporting campaigns using the following propagation methods,often endeavoring to gain the trust of victims using branding associated with the U.S. Centres for Disease Control and Prevention (CDC) and the World Health Organization (WHO), as well as country-specific health agencies such as the Public Health Centre of the Ministry of Health of Ukraine and China’s Ministry of Health, and companies such as FedEx. Examples include:

Emails

There are a range of emails using COVID-19 to grab peoples interest. Examples include:

• working from home statements from supervisors/managers (Director of Milan University)
• requesting donation to fake WHO COVID-19 response fund
• recommendations to avoid infection
• blackmailing people to pay ransom or risk family member being infected
• statements from health authorities (WHO, CDC, MoH, etc)

Often these will include attachments with malware or links that take you to a website or file download or ask you to login.

Phone

Receiving phone calls

• Impersonating an authority to carry out a variety of scams, from gaining access to your account to phony donation requests and spreading of malware.
• pretending to be a hospital looking for payment for treatment of a friend or relative
• scams similar to the previously seen “microsoft” calling to clean a virus off your computer.

Receiving TXT message

• text messages that have a link that claims to direct people to testing facilities. This link is not legitimate and instead may install malicious software on your device that’s designed to steal your personal information, such as banking details

Web Sites

Criminals are cloning or crafting websites to facilitate their scams

• Fake anti-virus website promising coronavirus protection is actually delivering malware
• fake shops, websites, social media accounts, and email addresses claiming to sell medical supplies currently in high demand, such as surgical masks.
• clone of the (legitimate) Johns Hopkins University coronavirus map used to spread malware.
• offering to sell or provide fake cures, vaccines, and advice on unproven treatments for COVID-19

Please be careful about which websites you go to. Our advice is to to only use trusted and verified information sources from government and research institution’s websites. Ideally by going directly to them rather then clicking off links in unsolicited emails.

Social Media Sites

• Be cautious of legitimate fundraising sites like GoFundMe that are used to solicit donations as this is a common tactic of criminals
• Watch for fake investment schemes using stocks being promoted via social media where there is a claim about having a product or service that is able to prevent or treat COVID-19
• the obvious stupid or fake ‘trolls’ trying to get social attention by offering potentially dangerous advice
• offering to sell or provide fake cures, vaccines, and advice on unproven treatments for COVID-19

Malware and Mobile Apps

Criminals are associating branding from authoritative sources or creating apps that provide coronavirus information to get people to install apps that include malware / spyware on mobile devices.

• Coronavirus tracking apps like ‘corona live 1.1’ includes spyware that gives to attacker remote control over your device and the data it has access to.
• COVID19 tracker – another tracking app that includes ransomware and encrypts the users devices demanding bitcoin.

Think carefully about whether you really need an app, especially where you have no idea that it will actually provide accurate information. Please ensure that you download apps only from official app store for your phone and always check the permissions apps request on your device make sense.

Summary

Expect to see a wide range of COVID-19 related phishing emails, text messages, dodgy apps and fake web sites. These scams will likely focus on the our interest in COVID-19 virus spreading by informing of infections in your local area, vaccine and treatment offers, and supply shortages that have become critical.

If you are unsure about the website, do not proceed with any login procedures. If there is some general information that can be found searching through an online search, do that instead of clicking the link from a suspicious sender.

If there is any doubt to a received item, then you should contact AskOtago like normal.