Coronavirus con artists continue to thrive 0 427

Man working on laptop

The scam machine shows no signs of slowing down, as fraudsters continue to dispense bogus health advice, peddle fake testing kits and issue malware-laced purchase orders

As the Coronavirus pandemic continues to escalate, more companies are now shifting to remote work as a way of containing the spread of the disease. Similarly, lockdowns and travel bans, among other stringent measures, have become the order of the day across several nations. And to worsen the situation, there is a massive shortage of the required medical kits.

Such a crisis provides fraudsters undue advantage over a vulnerable lot that is financially destabilized, as well as emotionally drained as a result of the pandemic. 

In this case, you would likely receive fake updates regarding the pandemic, as well as non-existent offers for personal protective equipment, among others. Likewise, if you’re a business, you would certainly receive faux purchase orders and payment information.

Fortunately, as a follow up to our previous article about the ways scammers are exploiting coronavirus fears, we provide you with a few examples of the new campaigns aimed at stealing your money or personal information. To enable you to keep your guard up. Shall we?

Fake news/information

As the virus continues to escalate, more people are currently searching for practical information on how they can protect themselves. As a result, scammers have conveniently positioned themselves as the true COVID-19 information “crusaders” by impersonating well-known health organizations, such as the World health organization.

Don’t act surprised if you receive an email (containing an attachment) supposedly coming from a reputable health organization offering you “vital information” on how you can protect yourself from the disease.

For instance, our research team identified one such file containing a Trojan designed to steal personal credentials.

Apart from the WHO, fraudsters are also impersonating the US Centers for Disease Control and Prevention (CDC). Accordingly, the FBI has given a warning about scummy emails mainly riddled with malware-infested attachments and links purporting to originate from the CDC.

 To reduce the number of people falling for such schemes, the WHO shares examples of its official email addresses and methods of communication on its website.

Urgent purchase orders and late payments

Owing to the increased pressure from governments to reduce the spread of the virus, Companies, as well as factories, have been forced to streamline their operations according to the current situation. As an example, companies to integrate work from home modules, while factories to either increase or reduce their production capacities depending on their products.

Such erratic changes have brought about a climate of uncertainty that offers fraudsters a thriving environment.

In this case, as a factory owner or executive, be on the lookout for “urgent purchase orders” from “company representatives.” Since this fake orders come from scammers who want to make a kill out of your desperation of making some revenue before things go south.

Sadly, if you download such “urgent orders” (usually in attachments), your PC will be installed with malicious code designed to steal your details.

Below is an excellent example of such an “urgent order”:

Similarly, you would receive a “proof of payment” for you to take care of the order. However, like the last example above, instead of receiving a bank statement, the attached document contains a Trojan injector.

High demand products

A massive increase in demand compounded with an inadequate supply for essential protective items, such face masks has created another avenue for scams.

A typical example of such a scam involves a fraudulent site that is offering “OxyBreath Pro” face masks at a reduced price. These can lure you since there is a shortage of masks, and what is available is highly-priced.

However, if you click on the provided links, you’ll be at risk of exposing your sensitive personal information to the scammers.

Bogus testing gear

The unavailability or short supply of medical kits for testing folks for the virus has also attracted fraudsters in droves.

For instance, the existent low supply of masks, respirators, and hand sanitizers, among other necessities, has prompted scammers to impersonate medical officials.  So that, they can provide non-existent or fake COVID-19 test kits, as well as illegitimate “corona cures.”

As an illustration, more than 2000, links associated with fake coronavirus products have already been identified. Similarly, law enforcement bureaus alongside other relevant bodies have been able to seize US$ 13 million worth of potentially hazardous pharmaceuticals.

To contain these despicable actions, the U.S. Food and Drug Administration (FDA) has issued warnings that it hasn’t allowed the sale or purchase of coronavirus self-testing kits; therefore, it is currently bursting such sellers.

Final thoughts

In a wrap, what we have shared is a representative of the many current fraudulent campaigns doing rounds in our media spaces due to the prevailing situation.

Thus, it is critical to maintaining high alertness to avoid falling victim to both the COVID-19 pandemic, as well as the ensuing scam epidemic escalating through the internet. To keep yourself safe from the scams, you can practice the following basics:

  1. Avoid downloading files or clicking on links from unknown sources
  2. Never fall for unrealistic offers or order goods from unverified suppliers. You may also make a point of checking out the purported vendor’s reviews
  3. Invest in an excellent endpoint solution which can shield you from phishing attacks, as well as other forms of scams
  4. If an email suggests coming from a reputable organization, double-check with the firm’s website to confirm its authenticity

If you require consultation, as well as endpoint solutions for your cybersecurity needs, then ESET has been here for you for over 30 years. We want to assure you that we will be here to protect your online activities during these uncertain times, too.

Protect yourself from threats to your security online with an extended trial of our award-winning software.

Try our extended 90-day trial for free.

Previous ArticleNext Article

How To Improve Communication Security with MFA 0 630

Person working on two factor authentication

Remote work can be much safer with the basic cyber-hygiene practices in place – multi-factor authentication is one of them

If you are working from home due to the coronavirus pandemic, it is essential to integrate two-factor authentication (2FA) or multi-factor authentication in your daily login routine. That way, you can beat fraudsters at their own game, since the security of your essentials isn’t wholly dependent on passwords alone.

The interesting bit with this technology is that you may have already seen it in action; for instance, when requesting access to your bank account via your smartphone. In this case, you must enter the one-time code sent to you in addition to your password to gain access.

See, enabling such double authentication processes on all your logins can make it difficult for scammers to access your accounts even if they compromise your passwords.

That said, you may now want to know which MFA option to use? Well, we take a look at some of the ways you can utilize MFA to bolster the security of your connections when working remotely.

  1. First, the use of a physical token

To implement this technique, you will require a physical device such as a security USB key, a key fob, or a similar item that will generate a secure code for verification purposes.

You’ll mostly be required to integrate this method if you need access to your cloud-based applications, online office applications, or corporate office technology. The YubiKey or Thetis is an example of such a device that you can purchase with less than US$50.

For convenience purposes, most of these devices are designed tiny; you can carry them in your pant pocket or hang them on a keychain for safety purposes. 

2. Use of a mobile phone

Most likely, you own a smartphone, right?

If yes, you can use it to boost your MFA security capabilities. For instance, you can download an authentication app such as Google Authenticator, ESET Secure Authentication, or Authy for your use.

The only caveat here is to ensure your source has a reputable security background. This is informed by the fact that the app is going to reside inside your smartphone, which is also vulnerable to security threats; therefore, robust security is required to avoid pre-emptying your security efforts.

Importantly, be on the lookout for spam messages when using your phone as they can trick you into compromising your accounts.

Fortunately, if you download applications from reputable sources, you can be offered a solution in case you have an issue with the platform itself.

3. Use of Biometrics

Factually, no single human being shares a fingerprint or retinal scan with another. This unique feature has been conveniently utilized overtime to provide robust multi-factor Authentication. 

You can also utilize the same to secure your connections.  For instance, you can take a picture of your face or scan your fingerprint using a biometric reader – currently, a common feature in smartphones or other devices ─, and then integrate it in your login procedure. These will prevent any other user from accessing your accounts or private information.

On the flip side, some folks feel that the technique is somehow creepy; therefore, give it a wide bath. Besides, it can present a challenge when you need to reset your bio features if your service provider is hacked.

Final thoughts

When scouting for a suitable MFA option for your needs, it is vital to consider one that can easily fit your routine. This stems from the fact that without proper utilization, an MFA option can’t protect you.

Similarly, an MFA technique can allow some side benefits as well. For instance, in the event of a security breach, you will be notified that your password has been interfered with; this can enable you to implement mitigation measures. Not only that, but you also get protected from the would-be attack since the fraudsters wouldn’t have access to your other factors.

In case you require a secure authentication application or consultation regarding MFA options, then ESET has been here for you for over 30 years. We want to assure you that we will be here to protect your online activities during these uncertain times, too.

Protect yourself from threats to your security online with an extended trial of our award-winning software. 

Try our extended 90-days trial for free.

3 Ways Scammers Are exploiting Coronavirus Fears 1 637

Types of Scams

From malware-laden emails to fake donations, these are some of the most common cons you should watch out for amid this public health crisis

It’s beyond reasonable doubt that the COVID-19 disease has transformed itself into a pandemic that has thrown the world into a tailspin. Panic is palpable than ever before, and as a result, has led to market closures, travel bans, lockdowns, and panic buying.

Unfortunately, cybercriminals are taking advantage of this chaotic situation to defraud the vulnerable. With more than 60,000 deaths witnessed across the globe due to the virus, fraudsters are finding an opportune moment for launching their fraudulent campaigns, usually disguised as humanitarian interventions.

Therefore, the big question is, how do you sniff potential scammers a mile away? Fret not, in this post, we share some of the common despicable tactics (as identified by the ESET research team) that are currently being used by scammers to defraud innocent souls.

  1. Malicious News

To appear as convincing as possible, the current retinue of scammers have resorted to impersonating authoritative sources, especially those concerned with disseminating news regarding the virus. Such include the world health organization (WHO) among many other firms.

As such, they will send you emails purporting to come from these sources that contain “vital information” regarding the disease to hoodwink you into clicking on their malicious links. Usually, such links may steal your personal information, install malware on your machine, or try to capture your password and login credentials.

Nevertheless, the good thing is that most of these organizations are aware of such fraudulent activities. And in a bid to end them, have come to the open regarding the issue. For instance, the WHO, on its website, offers advice on how it communicates and also elaborates on what to expect from their official emails.

As an example, one of the significant points reads:

“Make sure the sender has an email address such as ‘person@who.int’. If there is anything other than ‘who.int’ after the ‘@’ symbol, this sender is not from WHO. WHO does not send emails from addresses ending in ‘@who.com’, ‘@who.org,’ or ‘@who-safety.org,’ for example.”

What’s more, the organization advises that all its web content starts with https://www.who.int/ only, no other domain is used.  Therefore, be sure to check on the URL of the email sent to you before clicking on it. If in doubt, input the address directly onto your browser to get the results. Most importantly, the WHO cannot start sending you emails without your subscription or prompt. 

On the other hand, if you wanted the real news regarding the pandemic, you can visit the dedicated WHO site or head to your national health care institution’s website. For instance, the National Health Service if you are a United Kingdom resident or Center for Disease Control and Prevention if you live in the US.

Alternatively, you can get real information from your usual trusted sources, but not from unsolicited emails.

In another case (as shown in the image below), the fraudsters are trying to impersonate the wall street journal by establishing a visually similar site (phishing site).

From the image, you can notice that the URL starts with ‘worldstreet’ while the wording on the webpage indicates ‘world street,’ which is a red flag.

By creating such a site, they trick people into believing that they are the real wall street journal, therefore gain some revenue from the advertisements placed there. Though the site may not track your credentials, the money generated goes to the wrong hands.

2. Appeal for donation

In another attempt to outsmart the would-be victims, cybercriminals are now packaging themselves as “genuine souls” out there to help in the war against the virus.  For instance, in a recent scam, fraudsters were attempting to persuade their audience to contribute towards the development of a vaccine for children in China.

An interesting fact about this example is that the perpetrators are riding on the popularity of an existing campaign by re-purposing its content with Coronavirus details. In another 2019 publication, we talked about how criminals were threatening their victims in an attempt to extort money from them.

Often, such corona themed scams will request you to send your donations in the form of bitcoins to a particular fraudster’s wallet. Though the trick might work on a few people, if done on a global scale can rake in colossal sums of money, which makes it attractive to the criminals.

3. Dubious purchases

The increasing demand for particular products such as face masks and hand sanitizers due to the pandemic has resulted in their short supply. Naturally, this has attracted fraudsters who, according to Sky News, have conned around £800,000 (US$1 million) from United Kingdom residents within February alone.

In an attempt to steal your money, the fraudsters will send you spam emails purporting to help you secure face masks. In case you unwittingly click on the provided links, your financial and personal credentials will be revealed to the fraudsters.

Therefore, you should always be on the lookout for such claims, and only purchase such items from a trusted dealer.

Final thoughts

These are examples of a few tactics currently being used by cybercriminals in their attempts of defrauding people their hard-earned money as a result of the current confusion brought about the COVID-19 stalemate.

Thus, as a business or individual, you need to remain vigilant regarding such antics, not only during such emergencies but also during other times.

As a way of minimizing your chances of falling victim to such schemes, you can always practice some of the following basics:

  1. Be worrisome of emails containing alarming messages regarding the pandemic and the need for immediate action; for instance, ordering for a vaccine or cure via the provided links.
  2. Avoid replying to unknown messages requiring your credentials; for example, those needing your bank details and identification number, among other sensitive information.
  3. Be proactive at identifying potential crowd-funding or fraudulent campaigns.
  4. Utilize well-known multi-layered security software, which includes protection against phishing.

More Importantly, ESET has been here for you for over 30 years. We want to assure you that we will be here to protect your online activities during these uncertain times, too.

Protect yourself from threats to your security online with an extended trial of our award-winning software.

Try our extended 90-days trial for free.