Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

5/20/2020
10:35 AM
50%
50%

Coronavirus-Themed Phishing Fears Largely Overblown, Researchers Say

As COVID-19-themed spam rises, phishing-not so much. An analysis of newly registered domains finds that only 2.4% are actually phishing sites aiming to steal credentials.

While many security firms have warned that massive spam campaigns employing coronavirus-themed messages in an attempt to fool potential victims into parting with their credentials, the incidence of COVID-19-specific phishing attacks is no higher than before the pandemic, according to a new report.

Lastline researchers found that 84% of newly registered domains did not have any content, while about 14% of domains led to a questionable landing page — or "gray zone" — that tried to sell counterfeit goods or questionable coronavirus-related products. Only 2.4% of sites were actually phishing for specific information from the victims, and only four campaigns, consisting of less than 800 URLs, were specifically designed to take advantage of the coronavirus pandemic.  

While cybercriminals are trying to cash in on people's coronavirus concerns, the specific use of coronavirus-specific information are lures to convince people to click on links and attempts at fraud or the sale of counterfeit goods, says Roman Vasilenko, engineering manager of Lastline's Anti-Malware Group. 

"The volume of attacks using the topic of COVID-19 did not change," he says. "Overall, phishing grew very considerably in March and then in April — it has basically doubled according to our numbers. But the targets of those landing pages — Bank of America and Chase Bank are the top ones — remain the same as before."

Domain Spike

Over the past two months, concerns have grown that cyberattackers were turning people's fear of the coronavirus into cybercriminal attacks. Coronavirus-related domain registrations skyrocketed, topping 2,000 domains a day in late March, according to intellectual-property protection firm MarkMonitor, which noted that the total number of pandemic-related domain registrations was set to pass 100,000 by late April. The same month, Google announced that 18 million of the approximately 100 million spam messages that the company blocks were related to coronavirus or the pandemic. 

In mid-April, three US senators wrote to domain registers to request information on their plans to combat pandemic-inspired fraud.

Yet, Lastline's analysis showed that, while spam operators and domain speculators had taken to pandemic themes, only 2.4% of newly registered domains with a COVID theme were actually phishing sites that tried to fool visitors into parting with their credentials. 

"[T]o our surprise, many of these phishing domains carry the same content that we have been aware of long before the pandemic," Lastline wrote in the analysis. "Very few of them lead to novel phishing campaigns that exploit coronavirus fears."

Lastline collected information on newly registered domains from the feeds of three different organizations: the Cyberthreat Coalition, PhishLabs, and the Cybersecurity and Infrastructure Security Agency (CISA). To analyze the newly registered domains, Lastline used image analysis to cluster the large number of landing pages that included a COVID-19 keyword into similar looking clusters. The recognition algorithm looked for specific elements — such as username and password fields — to identify those pages that attempted to collect credentials. 

In analyzing the similar-looking clusters, Lastline then grouped the phishing sites into three groups: Sites that used pre-pandemic content with some updates to match the current sites, such as banks posting disclaimers or offers to help with financial distress; sites that used a COVID-19 related keyword to lure users but did not change the content; and sites that specifically used the pandemic to attract and convince users to give up specific information.  

"Phishing e-mails are very related to what is happening to the world," says Vasilenko. "But phishing websites are focused on a goal."

The company discovered nearly 300,000 phishing URLs using the newly registered domains as part of a phishing attack. Removing campaigns that existed prior to the pandemic left only 795 URLs grouped in four campaigns, which targeted the World Health Organization, the Canada Revenue Agency, Netflix, and an electronic money transfer system.

The problem for cybercriminals is that while global news events such as the coronavirus pandemic attract attention and thus are the basis for a good lure, they do not often provide a good platform to fool victims into parting with information. 

"To gather credentials, the actors need to design and build at site to look like the target, often a bank," Vasilenko says. "That requirement does not change with COVID. Attackers still want to steal exactly the same thing."

Overall, pandemic-related phishing activity seemed to peak in the second week of April and has largely subsided, according to Lastline's analysis.

Related Content

 
 
Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really  bad day" in cybersecurity. Click for more information and to register
Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
How to Identify Cobalt Strike on Your Network
Zohar Buber, Security Analyst,  11/18/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: A GONG is as good as a cyber attack.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25660
PUBLISHED: 2020-11-23
A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the Ceph...
CVE-2020-25688
PUBLISHED: 2020-11-23
A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certificate from the source repository. This would result in all installations using the same certificates. If an attacker could observe network traffic internal to a...
CVE-2020-25696
PUBLISHED: 2020-11-23
A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating sy...
CVE-2020-26229
PUBLISHED: 2020-11-23
TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability...
CVE-2020-28984
PUBLISHED: 2020-11-23
prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters.