IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Fear of Delta variant prompts new COVID phishing scams

Increase in email attacks taking advantage of vaccine requirements by businesses

Security researchers have detected a significant increase in email attacks and scams taking advantage of increased fears of Delta variant spread and vaccine requirements in businesses.

According to Proofpoint security researchers, hackers have sent fake employment termination emails to and spoofed emails from HR with vaccination status forms. The emails’ goals were to spread dangerous malware and steal company login details.

Researchers said there has been a marked increase in COVID-19-related threats since late June 2021. Hackers spread RustyBuer, Formbook, and Ave Maria malware, and launched multiple corporate phishing attempts to steal Microsoft and Office 365 credentials. 

The increase in coronavirus scams has aligned with public interest in the highly contagious COVID-19 Delta variant. According to global Google Trend data, global searches for “Delta variant” first peaked last week and have continued growing through August 2021. 

Researchers saw tens of thousands of phishing messages intended for recipients in various industries worldwide. They also observed multiple high-volume COVID-19-related credential-theft campaigns, including a Microsoft credential-theft campaign targeting thousands of organizations globally. The messages masqueraded as vaccination self-compliance reports sent by the target entities’ human resources divisions.  

As many major American companies began requiring employees to be vaccinated before returning to the office, researchers warned that “it is likely this type of lure theme will be used by threat actors”.

Related Resource

Prevent fraud and phishing attacks with DMARC

How to use domain-based message authentication, reporting, and conformance for email security

Prevent fraud and phishing attacks with DMARC - whitepaper from MimecastFree download

The emails had similar characteristics, including claiming to be from  HR departments and COVID-related subject headers, such as “Covid-19 Vaccination Self Compliance Report.” The messages contained a URL that likely leads to a fake Microsoft authentication page that harvests user credentials.

Researchers also saw a high-volume Formbook campaign sent to hundreds of organizations posing as a human resource professional. The emails contained a .ZIP file (e.g. Scan.Salary.zip) and told the recipients their jobs are being eliminated due to the financial impact of COVID-19. 

“To further entice the recipient to open the malicious file, the email states a ‘2 months salary receipt’ is attached. The emails contain a malicious .ZIP attachment, that when extracted and executed leads to the installation of Formbook malware. This campaign consisted of over 7,000 emails intended for a broad spectrum of organizations,” researchers said.

Researchers added that based on past behavior, media attention increases the likelihood actors will shift back to broader adoption of COVID-19 as social engineering material and localize that material to their prospective regions.

“It is possible more threat actors will begin to use the virus as a lure in future campaigns while infection rates and interest in the virus and protective measures remains high,” the researchers added.

Featured Resources

The state of Salesforce: Future of business

Three articles that look forward into the changing state of Salesforce and the future of business

Free Download

The mighty struggle to migrate SAP to the cloud may be over

A simplified and unified approach to delivering Enterprise Transformation in the cloud

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

The Total Economic Impact™ Of IBM FlashSystem

Cost savings and business benefits enabled by FlashSystem

Free Download

Recommended

Twilio account breach result of sophisticated social engineering campaign
Security

Twilio account breach result of sophisticated social engineering campaign

9 Aug 2022
Over 200,000 DrayTek routers vulnerable to total device takeover
Security

Over 200,000 DrayTek routers vulnerable to total device takeover

3 Aug 2022
Data on 69 million Neopets users stolen and listed for sale on hacker forum
Security

Data on 69 million Neopets users stolen and listed for sale on hacker forum

21 Jul 2022
What is zero trust?
network security

What is zero trust?

14 Jul 2022

Most Popular

Cyber attack on software supplier causes "major outage" across the NHS
cyber attacks

Cyber attack on software supplier causes "major outage" across the NHS

8 Aug 2022
Why convenience is the biggest threat to your security
Sponsored

Why convenience is the biggest threat to your security

8 Aug 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022