Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

5/20/2020
10:35 AM
50%
50%

Coronavirus-Themed Phishing Fears Largely Overblown, Researchers Say

As COVID-19-themed spam rises, phishing-not so much. An analysis of newly registered domains finds that only 2.4% are actually phishing sites aiming to steal credentials.

While many security firms have warned that massive spam campaigns employing coronavirus-themed messages in an attempt to fool potential victims into parting with their credentials, the incidence of COVID-19-specific phishing attacks is no higher than before the pandemic, according to a new report.

Lastline researchers found that 84% of newly registered domains did not have any content, while about 14% of domains led to a questionable landing page — or "gray zone" — that tried to sell counterfeit goods or questionable coronavirus-related products. Only 2.4% of sites were actually phishing for specific information from the victims, and only four campaigns, consisting of less than 800 URLs, were specifically designed to take advantage of the coronavirus pandemic.  

While cybercriminals are trying to cash in on people's coronavirus concerns, the specific use of coronavirus-specific information are lures to convince people to click on links and attempts at fraud or the sale of counterfeit goods, says Roman Vasilenko, engineering manager of Lastline's Anti-Malware Group. 

"The volume of attacks using the topic of COVID-19 did not change," he says. "Overall, phishing grew very considerably in March and then in April — it has basically doubled according to our numbers. But the targets of those landing pages — Bank of America and Chase Bank are the top ones — remain the same as before."

Domain Spike

Over the past two months, concerns have grown that cyberattackers were turning people's fear of the coronavirus into cybercriminal attacks. Coronavirus-related domain registrations skyrocketed, topping 2,000 domains a day in late March, according to intellectual-property protection firm MarkMonitor, which noted that the total number of pandemic-related domain registrations was set to pass 100,000 by late April. The same month, Google announced that 18 million of the approximately 100 million spam messages that the company blocks were related to coronavirus or the pandemic. 

In mid-April, three US senators wrote to domain registers to request information on their plans to combat pandemic-inspired fraud.

Yet, Lastline's analysis showed that, while spam operators and domain speculators had taken to pandemic themes, only 2.4% of newly registered domains with a COVID theme were actually phishing sites that tried to fool visitors into parting with their credentials. 

"[T]o our surprise, many of these phishing domains carry the same content that we have been aware of long before the pandemic," Lastline wrote in the analysis. "Very few of them lead to novel phishing campaigns that exploit coronavirus fears."

Lastline collected information on newly registered domains from the feeds of three different organizations: the Cyberthreat Coalition, PhishLabs, and the Cybersecurity and Infrastructure Security Agency (CISA). To analyze the newly registered domains, Lastline used image analysis to cluster the large number of landing pages that included a COVID-19 keyword into similar looking clusters. The recognition algorithm looked for specific elements — such as username and password fields — to identify those pages that attempted to collect credentials. 

In analyzing the similar-looking clusters, Lastline then grouped the phishing sites into three groups: Sites that used pre-pandemic content with some updates to match the current sites, such as banks posting disclaimers or offers to help with financial distress; sites that used a COVID-19 related keyword to lure users but did not change the content; and sites that specifically used the pandemic to attract and convince users to give up specific information.  

"Phishing e-mails are very related to what is happening to the world," says Vasilenko. "But phishing websites are focused on a goal."

The company discovered nearly 300,000 phishing URLs using the newly registered domains as part of a phishing attack. Removing campaigns that existed prior to the pandemic left only 795 URLs grouped in four campaigns, which targeted the World Health Organization, the Canada Revenue Agency, Netflix, and an electronic money transfer system.

The problem for cybercriminals is that while global news events such as the coronavirus pandemic attract attention and thus are the basis for a good lure, they do not often provide a good platform to fool victims into parting with information. 

"To gather credentials, the actors need to design and build at site to look like the target, often a bank," Vasilenko says. "That requirement does not change with COVID. Attackers still want to steal exactly the same thing."

Overall, pandemic-related phishing activity seemed to peak in the second week of April and has largely subsided, according to Lastline's analysis.

Related Content

 
 
Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really  bad day" in cybersecurity. Click for more information and to register
Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-20001
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic elements inside sift_up or sift_down_range panics. This bug leads to a drop of zeroed memory as an arbitrary type, which can result in a memory ...
CVE-2020-36317
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the sam...
CVE-2020-36318
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.
CVE-2021-28875
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow.
CVE-2021-28876
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the same index when the underlying iterator panics (in certain conditions). This bug could lead to a memory safety violation due to an unmet safety r...