sb-eu logo
Story image

MailGuard intercepts sinister cybercrime emails notifying users of COVID-19 “relief payment”

Cyber criminals have sent out a series of malicious emails attempting to manipulate users suffering from financial turmoil and difficulties triggered by the COVID-19 crisis.

According MailGuard, which intercepted the emails, the emails have similar titles such as See Covid19 relief payment that has been paid or BLOCKCHAIN: See Payment Approval for Covid19 Donation. The sender addresses are likely to be from compromised email accounts, with some from what appear to be a legal firm or similarly trustworthy sources such as a Christian school.
The email informs the recipient that their account has been credited for the Covid_19 donation and that the payment confirmation page is attached. A link to this page is provided, titled Promocode_fe33e, along with a PDF image.

Unsuspecting recipients who click on the link to view the page are led, not to a PDF file, but an HTML page hosted on with its background blurred.

A message appears at the front of this page, titled Account Payable Shared A File With You. A file labelled Remittance Advice is included, along with a link to download the file.

Clicking on the button titled Open currently leads to an error page.

"This is a particularly sinister scam as cybercriminals are attempting to exploit users who may be suffering from financial difficulties as a result of the economic uncertainty caused by the COVID-19, MailGuard says.

"Scammers are well-aware that many individuals and businesses are currently in desperate need of economic assistance. Cruelly, these attackers are capitalising on this hardship to steal even more from those who are already suffering."

Ways this email scam has attempted to exploit users, according to MailGuard:

  • The use of a subject line like See COVID19 relief payment that has been paid. This creates intrigue among recipients, or even excitement among those who are actually expecting financial assistance. This may motivate them to click on the link without pausing to check for the emails legitimacy.
  • The sender address implies the email is from a legal firm, Christian school or similar respected institutions. This isnt unexpected and is plausible that a notice of this nature may be sent with a COVID-19 relief notification, thereby not raising any alarm bells.

Despite these techniques, eagle-eyed recipients of this email would be able to spot several red flags that point to the email being a fraud, MailGuard says. These include the fact that the email does not address the recipient directly, and that the link included in the email does not actually open a PDF, as implied. Several grammatical errors like in few working days and spelling errors (Covid_19) are also red flags that this email is, in fact, not legitimate.

"The practice of launching cyberattacks that are centred around ongoing trends isn't anything new. Cybercriminals have long employed these tactics to take advantage of any disruptions and vulnerabilities in the hope that users uncertainties and fear around new changes will get better of them and they will not pause to check for the legitimacy of these emails," says MailGuard.

"Coronavirus-themed cyberattacks are designed to play with human psychology and emotions, like this one we intercepted a few weeks ago. As such, we strongly advise being extra vigilant when you receive emails such as these and lookout for any tell-tale signs that might be suspicious."

As a precaution, MailGuard urges you not to click links within emails that:

  • Are not addressed to you by name.
  • Appear to be from a legitimate company but use poor English or omit personal details that a legitimate sender would include.
  • Are from businesses that you were not expecting to hear from.
  • Take you to a landing page or website that is not the legitimate URL of the company the email is purporting to be sent from. 
Story image
Security teams face mounting stress, call for execs to step in
“With more organisations operating under remote work conditions, the attack surface has broadened, making security at scale a critical concern. This is a call to action for executives to prioritise alleviating the stress."More
Story image
Beware of these six L7 DDoS attacks
As more services are migrating online, DDoS attacks are increasingly shifting away from the network layer, and into the application layer, writes Radware product marketing manager Eyal Arazi.More
Story image
Increased demand for cloud computing as organisations look to achieve business continuity - Aruba
The increase in remote working has also created a focus on cyber security for all businesses.More
Story image
Internet outages drastically increased during COVID-19 lockdowns, report finds
Global internet disruptions increased 63% in March, with internet service providers hit the hardest. This is according to the 2020 Internet Performance Report from ThousandEyes, the internet and cloud intelligence company.More
Story image
Cyber criminals turn to Gmail and AOL to advance attacks
“Securing oneself against this threat requires organisations to take protection matters into their own hands - this requires them to invest in sophisticated email security that leverages artificial intelligence to identify unusual senders and requests."More
Story image
Network intelligence is stopping a wave of DDoS misdiagnosis
Security teams already know the value of a layered defence; it’s time to add more layers, writes ThousandEyes principal solutions analyst Mike Hicks.More