BOOK AN APPOINTMENT WITH AN IT SPECIALIST TODAY

Beware: COVID-19 Vaccine News May Lead to New Wave of Phishing

COVID-19 Vaccine Related Phishing and How You Can Protect Your Organization

As the COVID-19 pandemic continues to claim lives across the globe and infection rates continue to soar, scientists are continually looking for a solution to end the world’s suffering. In the past weeks, vaccine manufacturers, such as Moderna and Pfizer-BioNTech, have published encouraging results from the last stages of their vaccine trials, giving the world a glimpse of hope.

However, with all these vaccines that have been developed and those in their final stages, none has been officially released for mass consumption. As the population continues to get overwhelmed with pandemic fatigue and scientists get closer to developing a real vaccine, cybercriminals are now using the developed vaccines as a ploy in their extortion activities.

COVID 19 Vaccine

What are phishing emails?

Phishing is a form of social engineering often used by cybercriminals to trick their targets into providing them with their personal information and account data. Once this information is obtained, these malicious actors use the targets’ credentials or install malware into their systems to obtain data. Phishing is carried out via text messages, instant messages, social media messaging platforms, phone calls, or email. However, phishing emails are the most common. The recipient of the email is usually tricked into clicking on a malicious link, which may lead to the installation of malware that may obtain sensitive information or freeze the recipient’s system as a way to deny services as part of a cyberattack.

At the initial stages of the COVID-19 pandemic, these emails came in different forms with luring subject lines such as:

  • What to do if you have come into contact with someone with COVID-19.
  • Free COVID-19 testing emails.
  • Advice on what to do if you have violated COVID-19 health protocols.

The main aim of these emails was to exploit the anxiety surrounding the pandemic. With the vaccine in sight and the topic naturally arousing excitement and attention, these emails are now being tailored to announce the promise of COVID-19 vaccines.

How can you identify phishing emails? As an organization, you have probably already started seeing vaccine-themed phishing emails or may expect to start seeing these emails in the next few weeks. But how exactly do you distinguish these fake emails from verified ones to protect your employees and ultimately protect your organization’s systems?

Here are several tips to help you identify phishing emails:

  1. Legitimate companies don’t request sensitive information via email: The chances are that if you receive an email purporting to be from a legitimate institution that provides you with an attachment or link and asks you to provide sensitive data, it’s a scam. Most verified organizations don’t send emails asking for credit card information, account usernames and passwords.
  2. Legitimate companies don’t send unsolicited links or attachments: Unexpected emails that contain links and attachments reek of hackers. Authentic organizations don’t randomly send you emails with links or attachments; they usually direct you to their websites.
  3. Look out for spelling errors: The easiest way to recognize a phishing email is terrible grammar. Emails from a verified organization are usually well-written.
  4. Legitimate companies have domain emails: Don’t only check the name of the person sending you the email, also check the email address. Most companies use their domain email addresses when sending out emails. However, this is not a foolproof method of identifying phishing emails.

How can you protect your organization against phishing attacks?

To protect your organization from phishing attacks, you need to practice vigilance. Training your employees on what to look out for when it comes to distinguishing phishing emails goes a long way toward protecting your organization from malicious attacks.

The following pointers will help to mitigate risks for phishing attacks:

  • Use two-factor or multifactor authentication methods to add an extra verification layer when logging in to sensitive applications.
  • Integrate firewalls to establish a barrier between your internal network and incoming traffic from external sources to block malicious traffic.
  • Keep all your software and applications updated.
  • Install security software such as antivirus, antispyware and anti-malware programs to help detect and remove malicious programs.
  • Enable email filtering to filter out incoming emails for phishing content and automatically move them to a separate folder.

No matter how secure your company’s network is, it only takes one reckless employee to fall victim to a phishing attack and send your company’s data into the hands of cybercriminals. Your employees need to understand and be able to recognize phishing emails to protect your organization.

More Like This

AA22-138B: Threat Actors Chaining Unpatched VMware Vulnerabilities for Full System Control

Original release date: May 18, 2022 Summary The Cybersecurity and Infrastructure Security Agency (CISA) is releasing this Cybersecurity Advisory (CSA) to warn organizations that malicious cyber actors, likely advanced persistent threat (APT) actors, are exploiting CVE-2022-22954 and CVE-2022-22960 separately and in combination. These vulnerabilities affect certain versions of VMware Workspace ONE Access, VMware Identity Manager …

AA22-138B: Threat Actors Chaining Unpatched VMware Vulnerabilities for Full System Control Read More »

Read More

AA22-138A: Threat Actors Exploiting F5 BIG-IP CVE-2022-1388

Original release date: May 18, 2022 Summary Actions for administrators to take today: • Do not expose management interfaces to the internet. • Enforce multi-factor authentication. • Consider using CISA’s Cyber Hygiene Services. The Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing & Analysis Center (MS-ISAC) are releasing this joint Cybersecurity Advisory …

AA22-138A: Threat Actors Exploiting F5 BIG-IP CVE-2022-1388 Read More »

Read More

AA22-137A: Weak Security Controls and Practices Routinely Exploited for Initial Access

Original release date: May 17, 2022 Summary Best Practices to Protect Your Systems: • Control access. • Harden Credentials. • Establish centralized log management. • Use antivirus solutions. • Employ detection tools. • Operate services exposed on internet-accessible hosts with secure configurations. • Keep software updated. Cyber actors routinely exploit poor security configurations (either misconfigured …

AA22-137A: Weak Security Controls and Practices Routinely Exploited for Initial Access Read More »

Read More

157-Year-Old Lincoln College Succumbed To A Ransomware Attack

157-Year-Old Lincoln College Succumbed To A Ransomware Attack On May 13th, 2022, a college that has remained open through two world wars, the 1918 Spanish flu epidemic, and the Great Depression will close its doors. The college has been struggling to stay afloat in recent years, and the coronavirus pandemic and a recent ransomware attack …

157-Year-Old Lincoln College Succumbed To A Ransomware Attack Read More »

Read More

AA22-131A: Protecting Against Cyber Threats to Managed Service Providers and their Customers

Original release date: May 11, 2022 Summary Tactical actions for MSPs and their customers to take today: • Identify and disable accounts that are no longer in use. • Enforce MFA on MSP accounts that access the customer environment and monitor for unexplained failed authentication. • Ensure MSP-customer contracts transparently identify ownership of ICT security …

AA22-131A: Protecting Against Cyber Threats to Managed Service Providers and their Customers Read More »

Read More

Zero Trust Networks: What Are They?

Zero Trust Networks: What Are They? The internet has brought a world of opportunity for businesses. It is easy for companies to reach out to consumers and offer them products or services without a physical storefront. However, this also opens businesses up to the risk of data breaches and cyber attacks. Cyber attacks can be …

Zero Trust Networks: What Are They? Read More »

Read More