Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

5/20/2020
10:35 AM
50%
50%

Coronavirus-Themed Phishing Fears Largely Overblown, Researchers Say

As COVID-19-themed spam rises, phishing-not so much. An analysis of newly registered domains finds that only 2.4% are actually phishing sites aiming to steal credentials.

While many security firms have warned that massive spam campaigns employing coronavirus-themed messages in an attempt to fool potential victims into parting with their credentials, the incidence of COVID-19-specific phishing attacks is no higher than before the pandemic, according to a new report.

Lastline researchers found that 84% of newly registered domains did not have any content, while about 14% of domains led to a questionable landing page — or "gray zone" — that tried to sell counterfeit goods or questionable coronavirus-related products. Only 2.4% of sites were actually phishing for specific information from the victims, and only four campaigns, consisting of less than 800 URLs, were specifically designed to take advantage of the coronavirus pandemic.  

While cybercriminals are trying to cash in on people's coronavirus concerns, the specific use of coronavirus-specific information are lures to convince people to click on links and attempts at fraud or the sale of counterfeit goods, says Roman Vasilenko, engineering manager of Lastline's Anti-Malware Group. 

"The volume of attacks using the topic of COVID-19 did not change," he says. "Overall, phishing grew very considerably in March and then in April — it has basically doubled according to our numbers. But the targets of those landing pages — Bank of America and Chase Bank are the top ones — remain the same as before."

Domain Spike

Over the past two months, concerns have grown that cyberattackers were turning people's fear of the coronavirus into cybercriminal attacks. Coronavirus-related domain registrations skyrocketed, topping 2,000 domains a day in late March, according to intellectual-property protection firm MarkMonitor, which noted that the total number of pandemic-related domain registrations was set to pass 100,000 by late April. The same month, Google announced that 18 million of the approximately 100 million spam messages that the company blocks were related to coronavirus or the pandemic. 

In mid-April, three US senators wrote to domain registers to request information on their plans to combat pandemic-inspired fraud.

Yet, Lastline's analysis showed that, while spam operators and domain speculators had taken to pandemic themes, only 2.4% of newly registered domains with a COVID theme were actually phishing sites that tried to fool visitors into parting with their credentials. 

"[T]o our surprise, many of these phishing domains carry the same content that we have been aware of long before the pandemic," Lastline wrote in the analysis. "Very few of them lead to novel phishing campaigns that exploit coronavirus fears."

Lastline collected information on newly registered domains from the feeds of three different organizations: the Cyberthreat Coalition, PhishLabs, and the Cybersecurity and Infrastructure Security Agency (CISA). To analyze the newly registered domains, Lastline used image analysis to cluster the large number of landing pages that included a COVID-19 keyword into similar looking clusters. The recognition algorithm looked for specific elements — such as username and password fields — to identify those pages that attempted to collect credentials. 

In analyzing the similar-looking clusters, Lastline then grouped the phishing sites into three groups: Sites that used pre-pandemic content with some updates to match the current sites, such as banks posting disclaimers or offers to help with financial distress; sites that used a COVID-19 related keyword to lure users but did not change the content; and sites that specifically used the pandemic to attract and convince users to give up specific information.  

"Phishing e-mails are very related to what is happening to the world," says Vasilenko. "But phishing websites are focused on a goal."

The company discovered nearly 300,000 phishing URLs using the newly registered domains as part of a phishing attack. Removing campaigns that existed prior to the pandemic left only 795 URLs grouped in four campaigns, which targeted the World Health Organization, the Canada Revenue Agency, Netflix, and an electronic money transfer system.

The problem for cybercriminals is that while global news events such as the coronavirus pandemic attract attention and thus are the basis for a good lure, they do not often provide a good platform to fool victims into parting with information. 

"To gather credentials, the actors need to design and build at site to look like the target, often a bank," Vasilenko says. "That requirement does not change with COVID. Attackers still want to steal exactly the same thing."

Overall, pandemic-related phishing activity seemed to peak in the second week of April and has largely subsided, according to Lastline's analysis.

Related Content

 
 
Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really  bad day" in cybersecurity. Click for more information and to register
Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-29565
PUBLISHED: 2020-12-04
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the...
CVE-2020-5675
PUBLISHED: 2020-12-04
Out-of-bounds read issue in GT21 model of GOT2000 series (GT2107-WTBD all versions, GT2107-WTSD all versions, GT2104-RTBD all versions, GT2104-PMBD all versions, and GT2103-PMBD all versions), GS21 model of GOT series (GS2110-WTBD all versions and GS2107-WTBD all versions), and Tension Controller LE...
CVE-2020-29562
PUBLISHED: 2020-12-04
The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.
CVE-2020-28916
PUBLISHED: 2020-12-04
hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address.
CVE-2020-29561
PUBLISHED: 2020-12-04
An issue was discovered in SonicBOOM riscv-boom 3.0.0. For LR, it does not avoid acquiring a reservation in the case where a load translates successfully but still generates an exception.