Coronavirus-Themed Phishing Fears Largely Overblown, Researchers Say

While many security firms have warned that massive spam campaigns employing coronavirus-themed messages in an attempt to fool potential victims into parting with their credentials, the incidence of COVID-19-specific phishing attacks is no higher than before the pandemic, according to a new report.

Lastline researchers found that 84% of newly registered domains did not have any content, while about 14% of domains led to a questionable landing page — or "gray zone" — that tried to sell counterfeit goods or questionable coronavirus-related products. Only 2.4% of sites were actually phishing for specific information from the victims, and only four campaigns, consisting of less than 800 URLs, were specifically designed to take advantage of the coronavirus pandemic.  

While cybercriminals are trying to cash in on people's coronavirus concerns, the specific use of coronavirus-specific information are lures to convince people to click on links and attempts at fraud or the sale of counterfeit goods, says Roman Vasilenko, engineering manager of Lastline's Anti-Malware Group. 

"The volume of attacks using the topic of COVID-19 did not change," he says. "Overall, phishing grew very considerably in March and then in April — it has basically doubled according to our numbers. But the targets of those landing pages — Bank of America and Chase Bank are the top ones — remain the same as before."

Domain Spike

Over the past two months, concerns have grown that cyberattackers were turning people's fear of the coronavirus into cybercriminal attacks. Coronavirus-related domain registrations skyrocketed, topping 2,000 domains a day in late March, according to intellectual-property protection firm MarkMonitor, which noted that the total number of pandemic-related domain registrations was set to pass 100,000 by late April. The same month, Google announced that 18 million of the approximately 100 million spam messages that the company blocks were related to coronavirus or the pandemic. 

In mid-April, three US senators wrote to domain registers to request information on their plans to combat pandemic-inspired fraud.

Yet, Lastline's analysis showed that, while spam operators and domain speculators had taken to pandemic themes, only 2.4% of newly registered domains with a COVID theme were actually phishing sites that tried to fool visitors into parting with their credentials. 

"[T]o our surprise, many of these phishing domains carry the same content that we have been aware of long before the pandemic," Lastline wrote in the analysis. "Very few of them lead to novel phishing campaigns that exploit coronavirus fears."

Lastline collected information on newly registered domains from the feeds of three different organizations: the Cyberthreat Coalition, PhishLabs, and the Cybersecurity and Infrastructure Security Agency (CISA). To analyze the newly registered domains, Lastline used image analysis to cluster the large number of landing pages that included a COVID-19 keyword into similar looking clusters. The recognition algorithm looked for specific elements — such as username and password fields — to identify those pages that attempted to collect credentials. 

In analyzing the similar-looking clusters, Lastline then grouped the phishing sites into three groups: Sites that used pre-pandemic content with some updates to match the current sites, such as banks posting disclaimers or offers to help with financial distress; sites that used a COVID-19 related keyword to lure users but did not change the content; and sites that specifically used the pandemic to attract and convince users to give up specific information.  

"Phishing e-mails are very related to what is happening to the world," says Vasilenko. "But phishing websites are focused on a goal."

The company discovered nearly 300,000 phishing URLs using the newly registered domains as part of a phishing attack. Removing campaigns that existed prior to the pandemic left only 795 URLs grouped in four campaigns, which targeted the World Health Organization, the Canada Revenue Agency, Netflix, and an electronic money transfer system.

The problem for cybercriminals is that while global news events such as the coronavirus pandemic attract attention and thus are the basis for a good lure, they do not often provide a good platform to fool victims into parting with information. 

"To gather credentials, the actors need to design and build at site to look like the target, often a bank," Vasilenko says. "That requirement does not change with COVID. Attackers still want to steal exactly the same thing."

Overall, pandemic-related phishing activity seemed to peak in the second week of April and has largely subsided, according to Lastline's analysis.

Related Content

Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really  bad day" in cybersecurity. Click for more information and to register.