Get It From The Source: Avoiding Covid-19 Vaccine Scams and More Trending Phishing Tactics

People are getting vaccinated! As Covid-19 infection and hospitalization rates decline again, we’re hopeful this time is different and with enough people getting access to effective vaccines there is light at the end of the tunnel to end the pandemic – at the very least in the form of achieving a managed level of endemic. We are all seeking a return to something approaching normalcy and an end to the terrible consequences this virus continues wreak on families in our country and across the globe.

Not dissimilarly to public health officials urging us to keep our guard up and that this is still a critical time to make the right decisions to ensure the tools and measures we have to fight covid are most effective, today we’d like to take time to remind people that we’re in a critical time for vigilance against pandemic driven phishing campaigns.

Towards the beginning of the pandemic we began reporting on the uprise of ‘covid scams’ like the infamous WHO impersonations and others targeting individuals fears and demand for information about Covid-19, as well as organizations scrambling to scale up remote work capabilities. Throughout the shifting waves of the pandemic and emerging cultural and technological trends that have accompanied them, new and shifting opportunities for malicious actors to catch people off their guard and design clever scams have arisen in lock step.

Statistics Canada determined that more than one in three Canadians have received a phishing attack, and we suspect it may be significantly more prevalent than that. Opportunities for effective phishing campaigns have increased across the board, especially retail related scams due to continuing increase in online business due to public health measures. Human Resources related phishing emails with malicious attachments is another booming trend, as it is especially easy to a) anticipate what type of content employees are expecting to receive, and b) that content is new and being sent out rapidly which diminishes employees’ abilities to spot discrepancies between standard communications and fraudulent ones. More recently phishing campaigns related to vaccine information and booking have emerged, as well as scam emails related to supporting Covid-19 initiatives and donating to relief funds for hard-hit regions.

This is an especially risky time for these types of phishing campaigns because, as we hinted at, our ingrained defences to spot things out of the norm are being compromised by both the novelty of legitimate content we’re receiving, and our expectation of receiving it. To put it another way, when the world is least normal in the general sense; it’s most difficult to distinguish anomalies in the particular sense.

Let’s take the example of receiving an email invitation to register for your first Covid-19 vaccine dose. This is not a communication that any of us are familiar with, and yet it is one that most of us are eagerly awaiting, do not want to miss out on, and must respond to promptly. That is a recipe for risky clicking. Determining the legitimacy of such emails has not been easy, especially early on. You may register with your local health unit or a specific clinical organization, but the booking may then come from a unified booking system being used across many provincial organizations. Domain lookups for registration links were found by some to be registered to Her Majesty the Queen in right of Ontario, and others revealed only AWS. Assuming most folks are less persistent than cybersecurity consultants in verifying these types of things, it represents a huge opportunity for scammers.

Normally, we like to tell you not to click on links or open attachments that you’re not expecting, but that advice falls short when we are all, as a whole, expecting to receive new-to-us communications. Given the astounding quality of some of the phishing email templates and landing pages we’ve been seeing lately, combined with a population that is anxious, expectant and more active online than ever before, this is a time for deeper caution.

So, what should you do? Well, hopefully none of this information is new to you, but we will take any opportunity we’re given to remind everyone:

• Don’t click on links or open attachments you’re not expecting
• Verify that URL links and sender e-mail addresses look right, and better yet dig into domain registry and reputation info if you’re not sure
• Be suspicious of content that doesn’t look or read quite right like typos, grammatical mistakes or even style and tone
• Don’t give out sensitive information online unless you’re certain you’re giving it to the right person via a secure method (and it’s really necessary)

For more detailed recommendations you can see some of our other relevant blogs, but maybe the best advice these days echoes Justin Bieber’s current hit “Peaches” in recommending you ‘get it from the source’. If instead of asking yourself “Does this have signs of being fake” you ask yourself “Could this still be fraudulent?” the answer is increasingly yes. So, as counterintuitive as it runs to our usual recommendations for tools and automations to leverage to make our business and personal lives most efficient, the best approach in some cases is to go to the source:

• Call the number from the official website to confirm if you should have received an email or text requesting that information. Do not use information from the email to validate the email.
• Call your manager or HR department to confirm you should be opening that attachment
• Go to the retailer website directly to find that deal on discounted Raybans that is just so enticing

This is good advice for individuals, but what about at an organizational level? At Secure Sense, we’re not in the habit of blaming end users. People will make mistakes—yes, sometimes ones they should have avoided—but it’s not productive to say that individuals are responsible for potential breaches given that something like 75-85% percent of breaches involve human interaction. Humans are security vulnerabilities, that’s still a fact of life; but we’re also invaluable assets to the strength of cybersecurity programs. Training is critical, but so is engagement–not only teaching people to recognize specific scams and phishing tactics, but fostering a mindset that is critical and discerning without instilling fear and blame that can lead to an aversion to these matters rather than attentiveness.

This blog entry has not been about showing off (and selling) sandboxes and gateways and zero-day malware prevention, etc., but investment in the right tech and proper implementation is still our collective best bet as organizations when it comes breach prevention and giving employees a fighting chance to avoid increasingly sophisticated phishing campaigns.  These are topics we love to discuss with anyone who wants to hear more. If you’re interested in reviewing your current posture against these or any threats, or the proven best approaches for effective awareness training, we’d love to hear from you.