In a year that has left us all feeling more vulnerable than ever, don’t let your inbox cause an ounce of extra stress. Stop those traps in their tracks and learn just how to spot a bad email in action. With our set of tips, discover just what to look for and exactly how to react as an email user. Protect yourself and your inbox from spam, phishing and malicious email.
The COVID-effect
As COVID-19 caused many of our daily tasks to move online, cyber criminals have been using the virus as a way to lure and trick users. Whether posing as a workmate, a COVID relief charity or even a health organization, 2020 saw cyber threats increase exponentially. Barracuda Networks found that phishing emails themed around the pandemic increased from 137 in January 2020 to 9,116 by the end of March—a growth rate of more than 600%.
With the population being more dependent on email than ever, ensure you’re in the know before diving into your inbox. We’ve gathered a few of the emerging and growing trends in spam, phishing and harmful content in emails.
COVID-19 Phishing
COVID-19 presented an opportunity for hackers like never before. Hackers created emails from government agencies and health organizations, requesting logins, password resets, presenting funding links and job opportunities during a time when many jobs were looking precarious. While others moved their office to home, COVID-19 phishing moved towards disguising emails to look like they were coming from your IT department.
While the pandemic exists, hackers will continue to adjust their methods to suit the situation. With sophisticated techniques that are ever-changing, users need to stay on top of what to look out for. During this COVID era, the most common phishing attacks were scamming, brand impersonation and business email compromise – with the goals being distributing malware, stealing credentials, and financial gain.
How to react:
- Companies need to be at the ready to quickly respond to any potential phishing threat. Respond to any attacks as quickly as possible
- Check the URLs of those charity pages in an email before taking any action. See if they look like a spoofed login page, or feature a logo that’s not quite spot-on
- Ensure you use DMARC reporting and analysis to help you protect your domain or brand from being hijacked and potentially contacting your staff working remotely
- Make sure your staff are being hyper vigilant as they work remotely, not falling for email attacks and becoming familiar with what to look out for
Deceptive Phishing
On a broader scale, deceptive phishing is the most common type of phishing scam. Here fraudsters impersonate an existing company to steal personal data and login credentials. Cyber criminals often use a sense of urgency to cause panic and make users do as they ask. Here are some of the techniques most used in deceptive phishing:
- Using legitimate-looking URL links for an organization, and spoofing that organization (replicating info, images, branding)
- Shortened URLs (often Bitly) may be used to trick users (so you can’t fully inspect the URL, and so they’re rarely blocked), before asking for credentials then redirecting to legitimate web pages
- Some email filters can spot when a logo has been stolen, so some cyber criminals will use a recognizable logo but change attributes, like the color (keep an eye out!)
- To fall through other filters, hacker emails may be very light on content and use an image instead of text
- Always be wary of attachments, especially those requesting you update your details by clicking on them
How to react:
- Inspect all URLs carefully to see if they redirect to an unknown or suspicious website
- Look out for very general language including generic salutations and limited email personalization
- Inspect if there are any tell-tale grammar mistakes and spelling errors – if something is raising a red flag, get out!
Scams
A technique targeting vulnerabilities and empathy, scams are a classic form of phishing, with new trends cropping up all the time. During COVID-19 there were trends selling masks, cures and vital information. Others claim foreign lottery wins, investment opportunities, outstanding invoices, or even send sextortion messages (messages claiming an attacker has obtained embarrassing information about you through search history or webcam footage).
Some scammers create company names that are oh-so-close to large existing companies, and some try to scare personal information out of you. Now’s the perfect time to make use of that spam folder in your inbox…
How to react:
- When you spot a scam email, make sure you “mark as spam” to help your email service provider recognize them in the future
- Be careful around emails with attachments and links that you’re not sure of
- Watch out for communications from sources you’d not normally receive emails from, and scrutinize them closely
- Use some caution even with companies you do communicate with, looking for signs of brand impersonation (e.g tweaked logos)
- If you are looking at investing or donating, find credible sources to work with directly, rather than going through an email
- Spot the flaws!
Malware
Malware is any software designed to damage a computer, server, client or network. Malware includes viruses, worms, Trojan horses, ransomware, spyware and more. It can be installed on your computer through an email.
One form of malware that’s fast becoming a malicious email trend is Emotet. Emotet is a banking Trojan that collects financial information by injecting computer code into an infected computer, allowing data to be stolen. Emails with this particular Trojan often feature links or attachments that look like genuine invoices, financial documents, shipping information, resumes, scanned documents, or information on COVID-19 – but are all fake.
The embedded malicious code often acts as a downloader for even more malicious code, and some is designed to steal login credentials for email accounts on infected systems. These credentials can then be given to a spam bot that sends out emails to spread the malware further. Emotet can even use content of an existing email conversation to make an email look legitimate.
How to react:
- Know that no one is immune to malware – individuals and businesses can be targeted
- Disable macros in MS Office, and only enable those that are digitally signed or are from trusted locations
- Use email filters to block Emotet documents
- As always, be aware of links and attachments
- If you fear that you may have already been targeted, notify your contact list warning them not to open an email from you
Not all trends are a good idea to jump on, especially those of the malicious email variety! Ensure you and your workplace know just what to look out for in this ever-changing landscape of email. Take that extra time to scrutinize your inbox and keep your computer properly protected.
