Could You Spot These Coronavirus Cyber Scams?

Ray Cogan
concept image of computer virus

Editor's note: This article originally appeared on The PhishLabs Blog.

By this time, most everyone in the world has heard about COVID-19, a global outbreak that is commonly referred to as the coronavirus. With growing fear and a lack of information, the stock markets have dropped to lows we haven’t seen in years, and organizations everywhere are putting together contingency plans. Like most global events, this scenario creates a perfect opportunity for threat actors to abuse the situation.

Why? Because:

  1. The pandemic has people in a state of fear and irrationality;
  2. The event is recognized worldwide, which means anyone with internet connectivity is a potential target;
  3. End-users are hungry for updates from their company, the media, or third parties regarding the coronavirus, thus adding a sense of legitimacy to the messages sent by threat actors.

PhishLabs has observed multiple threat campaigns using coronavirus to lure victims. The two examples below illustrate common ways threat actors are exploiting it.

Example 1:

Our first example shows a lure that targets the general population by abusing the CDC name.

Visually, the link appears to go to a CDC site; however, mousing over it shows what the sender’s true intention is.

The site goes to  hXXps://www.farahii{dot}com/corona/owa.php , which is a compromised ecommerce site. The phishing site has since been mitigated. The sender email address also came from  nationalhealthcenter@gravitt{dot}net , which is an email address created from a compromised domain of someone associated with churches in Ohio.

Beyond WHO, the CDC is considered one of the primary sources of current information associated with the pandemic, which makes this lure highly concerning. In the lure, the threat actor has posted a link which they claim has an updated list of coronavirus cases in areas around your city. With a pandemic that spreads as quickly as this one has, most people are going to be curious and want to know just how bad it is in their surrounding area.

Example 2:

As the outbreak grows, we have seen multiple attacks using the threat of the coronavirus in an attempt to get end-users to click on a URL or respond back to the threat actor directly. As you can see in the example above, this lure is posing itself as an absence census (loose translation) in the midst of the coronavirus. This could be an effective lure on a couple of different levels.

The first is that it isn’t something that would necessarily surprise an employee to receive right now. With coronavirus being highly contagious and not preventable, many employees are planning on working from home until we have more information about how dangerous it is and have vaccines to protect us. In addition to this, many people may let curiosity get the best of them and click the link to find out if anyone in their organization has the coronavirus. Top this all off with the fact that this attack is using a legitimate Microsoft program (Office Forms) and you can see how an unsuspecting victim could think this was a legitimate message.

The link in question led to the following URL:

hXXps://forms.office{dot}com/Pages/DesignPage.aspx#FormId=pSCNckQL3UeUcCDzfL8tmlauPpJZd6hHiWrIh3YjTW1UQzlIMDFNN0k2WFhPWVZSRU9FVFBYUFc2Ui4u&Analysis=true

And the sender was  maccount@microsoft{dot}com.

Here, the threat actor is using actual Microsoft programs for the entire attack. In place of a phishing site, Office forms are used to host the content, which then sends out an email that uses a legitimate Microsoft email to appear as the sender.

One thing to point out about both of these lures – neither of them is beautifully crafted to imitate a government agency or any specific company. However, that is the beauty of using a worldwide pandemic as your lure, it doesn’t have to be. The inherent fear and urgency associated with coronavirus in everyday life are all that is necessary, and threat actors are aware of this and ready to take advantage. If the virus continues to spread, it’s important to keep this in mind and expect to see an increased number of emails around this topic. If things keep trending the way they are, fear and panic will continue to grow, and as fear grows threat actors are always ready to jump on a malevolent opportunity.

COVERAGE FOR IDENTITY THEFT

Take a minute to think through what you’d need to do if someone stole your identity. You might need to contact credit bureaus, your bank or even the Social Security office or DMV. Maybe you’d have to take time off work to get it all done.

If someone steals your identity, it takes time – and money – to straighten things out. That’s where  Identity Theft Recovery Coverage  from ERIE can help.

Talk to your  local ERIE agent  to learn more about what’s included and how to add identity theft insurance to your homeowners insurance  policy.

pool party Lindquist Insurance
By Ray Cogan July 21, 2025
Before your next BBQ, road trip, or storm watch, give us a call. Our experienced insurance advisors will review your current coverage, answer your questions, and help you feel confident that no matter what summer brings, you’re ready for it. Call Lindquist Insurance today or visit our website to schedule a policy revie
family on vacation
By Ray Cogan July 11, 2025
Before your next adventure, make sure you’re fully protected with the right car insurance. At Lindquist Insurance, we’re committed to helping Maryland drivers enjoy the journey with confidence. Call Lindquist Insurance (301) 694-3008 or visit www.lindquisinsurance.com to request a free, no-obligation quote.
Annapolis MD waterfront
By Ray Cogan June 24, 2025
Connect with an insurance agent in Frederick this summer. Find out why now is the ideal time to reach out and build a relationship with a local insurance agent you can trust.
dock in Annapolis MD
By Ray Cogan June 10, 2025
We offer business insurance in Frederick. Prepare for seasonal risks with business insurance that provides financial protection when natural disasters strike.
employee taking inventory
By Ray Cogan May 26, 2025
Is your insurance company keeping up with your growth? Our Frederick insurance agency offers personal and proactive services that keep you focused on growth.
heavy rain hitting gutters
By Ray Cogan May 12, 2025
We offer business insurance in Frederick. Prepare for seasonal risks with business insurance that provides financial protection when natural disasters strike.
cars in heavy traffic
By Ray Cogan April 28, 2025
Switch car insurance in Frederick and the surrounding areas with the help of an insurance agent. It can be a smooth and stress-free experience with the right insurance agent.
young female driver
By Ray Cogan April 15, 2025
We offer car insurance in Frederick. We work with first-time drivers to find a policy that fits their needs and budget without sacrificing the coverage needed to drive confidently.
alarm clock and money - Lindquist Insurance
By Ray Cogan March 25, 2025
Our insurance agent in Frederick can save you time and money. We can navigate the complexities of insurance, ensuring you get the best coverage at the most affordable rates.
More Posts