• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to footer
  • Jobs
  • Career
    • Cyber Security Training
    • Work from Home
    • Cyber Security Analyst
    • Remote Work – Six Ways to Keep Your Data Safe When Working Remotely
  • Field Guide
  • Newsletter Signup
  • Deals
  • News
AskCyberSecurity.com

AskCyberSecurity.com

Cyber Security News & Information

  • Home
  • Data Privacy
    • Gamers
    • Government Cyber Security
      • Legislation
      • Standards
        • What are the risks of computer security?
        • Medical Cyber Security
    • Social Media
  • Security
    • Data Breaches
    • Scams
    • Malware
  • Software
    • Apps
    • Web Browsers
  • Glossary
    • Cyber Security Acronyms
  • About Ask Cyber Security
    • Authors
    • Contact Us
  • VPN
    • How Do I Know If My VPN is Working?
    • Best Free VPN iPhone
    • Why Use a VPN?
    • NordVPN vs IPVanish
    • Private Internet Access Download
    • Best VPN for Streaming
      • TikTok VPN
    • VPN Porn
    • Computer Security Software – What You Really Need
  • Tutorials
  • ChatGPT
    • Does ChatGPT Save Data?
AskCyber Home » News » scam » Coronavirus Email Scam Spreads Malware Steals Banking Credentials

Coronavirus Email Scam Spreads Malware Steals Banking Credentials

2020-02-04 by Geo

Coronavirus email scam

Coronavirus Email Scam – Beware of Phishing emails, Malware, Fake Alerts, Spoof Websites, and Cyberthreats

A new Coronavirus Email Scam and a malware campaign both attempt to take advantage of people’s fears about the new Coronavirus. As the Coronavirus number of infected exceeds 20,000, the phishing email scam exploits people’s concern about the spread of the novel coronavirus (2019-nCoV) reported by the World Health Organization (WHO) to have originated in Wuhan, China. There is also a Coronavirus themed malware campaign distributed via spam email as well as the appearance of virus themed spoof websites. The goal of these cyber attacks is to steal banking credentials and your money.

The US Department of Homeland Security recently warned the public of an increase in Emotet malware attacks on businesses. The warning involves Emotet malware which is a top destructive malware infecting state, local, tribal, and territorial governments. The most destructive attacks have cost close to one-million USD to remediate.

The email scam targets people in Australia, Austria, Barbados, Germany, Hong Kong, Japan, Malaysia, Singapore, Spain, Switzerland, the United Arab Emirates, the United Kingdom and the United States. The malware primarily targets people in Japan. It is expected that the number of cyber threats, emails scams, and malware attacks will increase over time as the Coronavirus spreads further.

It’s common for hackers and scammers to use global news events, holidays, natural disasters, and health crises are all commonly used in phishing email attacks and malware campaigns. Unfortunately, opportunistic hackers also spoof donation websites in hopes of scamming money from donors who are trying to help people in need. Quality antivirus software can screen from malicious files and links. It can also be used to remove malware. Using a virtual private network (VPN) can prevent your credentials from being stolen by hackers.

READ: Phishing Emails Rank as Top Scam

Coronavirus Themed Malicious Files

According to cyber security research firm Kaspersky Lab malicious pdf, mp4, and docx files are circulating disguised as information relating to the novel Coronavirus. According to Kaspersky, “The file names imply that they include virus protection instructions, current threat developments, and even virus detection techniques.” However, downloading the files launches a malware attack instead.

Coronavirus Themed Malware Attacks

A malware attack launched from an email scam delivers Emotet malware and botnet cyber attacks via large volume spam emails. The emails primarily target Japan and contain messaging about newly reported cases of Coronavirus. The email urges the reader to open the attachment to read an important virus-related message and get helpful information.

What is Emotet Malware?

Emotet is a banking malware than can be used to download other malware to infected devices. It was designed to steal banking credentials for banking fraud. TA542 has used Emotet for banking fraud campaigns targeting banks in Germany, Austria, and Switzerland. The latest version of Emotet now uses third-party malware to carry out its work.

Emotet malware steals login credentials from web browsers and email clients. The malware can also steal the subject, body, sender’s name, recipient’s name and email address. It infects more devices by sending spam emails and forwarding itself to email contacts from an infected device. That’s why it is important to use a unique password for every online account.

Emotet malware is capable of reviving older email threads to increase infection rates.

The Coronavirus email scam and malware attack is the work of TAS542 a hacking group that has used malicious attachments in scam emails for their previous attacks. One of their more recent malware email scam campaigns contained activist Greta Thunberg themed content. The scam email contains an attachment that appears to contain an urgent message relating the spread of the novel Coronavirus but is instead a weaponized file.

What Is TA542?

TA542, also known as Mummy Spider, is an organized threat actor group that consistently uses a malware payload called Emotet. TA542 typically sends large scale spam email campaigns. The latest version of Emotet malware, aka Geodo, has been delivered in widespread global email phishing campaigns in North America, Central America, South America, Europe, Asia, and Australia.

Emotet malware has also been used to deliver more malware including Qbot, The Trick, IcedID, and Gootkit.

According to cyber security researchers at Proofpoint, TA542 uses subject lines that contain financial themes that usually refer to transactions, payments, or invoices. The scam emails contain malicious attachments or links to malicious documents. A typical Emotet scam email contains a Microsoft Word document or an Adobe .pdf attachment. It may have a malicious link in the body of the email. If the victim has macros enabled, the scam email installs Emotet onto their machines.

Coronavirus Email Scam

This email scam impersonates the United States Center for Disease Control (CDC) and virologists but is really a phishing email scam in disguise. The email attempts to scare recipients with news of a supposed infection in their area. It also provides information on safety measures to seem credible and increases the likelihood that the recipient opens the email.

A Coronavirus email scam was discovered in the wild as an email phishing attack by KnowBe4, Inc. This scam email is a bit different than the malware launcher version. According to Stu Sjouwerman at cyber security researcher firm KnowBe4, the email (Image 1) also attempts to impersonate the CDC and even includes some helpful virus prevention tips to increase its believability and the likelihood that the user clicks on the malicious link in the email body. If the recipient clicks on the link it leads them to a spoof website that is a credential phishing page.

KnowBe4 Coronavirus Image 1
KnowBe4 Coronavirus scam Email Image 1

Don’t Fall For Coronavirus Email Scams and Phishing Attacks.

Example Emotet Scam Email Subject Lines

  • ACH Payment Info
  • Payment Notification
  • Transaction for your invoice
  • Overdue payment
  • Paid Invoices
  • Sales Invoice
  • Status update
  • Document needed
  • New Order
  • Receipt for your invoice

How to Detect a Scam Email

Coronavirus scam emails may prompt you to check an updated map of the outbreak or even give you helpful virus-related information. Phishing emails may appear to originate from authorities, your local school system, the CDC, or World Health Organization (WHO). Phishing emails use scare tactic subject lines and content about supposed local infected people or keeping you and your family safe from the virus. The email might prompt you to open an attachment, click on a link, or even ask for donations to stop the spread of Coronavirus.

A scam email or spoofed website often contains grammatical errors. Although they may be designed to look just like legitimate emails from large corporations or charities, they often contain spelling or grammar errors common to someone who is writing in something other than their native language. For example, the phishing email discovered by KnowBe4, contains a grammatical error (“You are immediately advised to go through the cases above for safety hazard”) at the end of the last sentence in the body of the email.

Filed Under: scam Tagged With: email scam

About Geo

Geo Dvorak has experience in the privacy space, with a focus on highlighting the growing market for privacy professionals. He joined the Ask Cyber team to handle the jobs board.


Twitter

Primary Sidebar

Subscribe to Our Free Newsletter

We Don't Share or Sell Your Info

Web Browsers

Where Are My Saved Passwords in Chrome?

Google Removes 70 Malicious Browser Add-ons from Chrome Web Store

Firefox 75 Reports Your Browser Settings to Mozilla

Categories

Cyber Security Field Guide

Computer Security While TravelingGet Our Cyber Security Field Guide - Available on Amazon!

Recent Posts

Security Marketing Manager – Remote

Sr. Associate, Cybersecurity Architect – Pfizer

Strategic Customer Success Manager – Cybersecurity – Opportunity for Working Remotely

Top 20 Passwords Leaked on Dark Web

ISU Cybersecurity Leader Job Opening

Cyber Security News

Top 20 Passwords Leaked on Dark Web

… [Read More...] about Top 20 Passwords Leaked on Dark Web

Apple Warns of Actively Exploited Zero-Day Flaw

… [Read More...] about Apple Warns of Actively Exploited Zero-Day Flaw

IRS Stops Facial Recognition System for Online Access

… [Read More...] about IRS Stops Facial Recognition System for Online Access

National Cybersecurity Alliance Announces Data Privacy Week

… [Read More...] about National Cybersecurity Alliance Announces Data Privacy Week

More Cyber Security News

Tags

amazon Android Apple bitcoin China chrome CISA credit card DarkSide DHS DOJ Equifax Europe Facebook facial recognition FBI Firefox FTC games GDPR Google Government hacker identity theft India iPhone Iran IRS LinkedIn Microsoft North Korea PayPal phishing phishing email ransomware REvil Russia smartphone T-Mobile TikTok tutorial VPN WhatsApp WiFi Windows

Government

CBP Looks to Access Airline Passenger Data

FTC Releases Cyber Threat Video Playlist

Malware Found on US Government Funded Phones

UK NCA Reaches Out to Youth to Deter Cybercrimes

More Posts from this Category

Footer

Menu

  • Home
  • About
  • Authors
  • Newsletter Signup
  • PRIVACY POLICY

Search

Why Use a VPN?

NordVPN vs IPVanish VPN Review

NAVIGATION

  • Data Breaches
  • Data Privacy
  • Gamers
  • Scams
  • Malware

MEMBER NJCCIC

New Jersey Cybersecurity & Communications Integration Cell

STAY CONNECTED

  • Facebook
  • Instagram
  • Pinterest
  • YouTube
  • Twitter
  • RSS

Copyright © 2023 · AskCyberSecurity.com · METRONY, LLC

Go to mobile version