MailGuard intercepts sinister cybercrime emails notifying users of COVID-19 “relief payment”

Cyber criminals have sent out a series of malicious emails attempting to manipulate users suffering from financial turmoil and difficulties triggered by the COVID-19 crisis.

According MailGuard, which intercepted the emails, the emails have similar titles such as See COVID-1919 relief payment that has been paid or BLOCKCHAIN: See Payment Approval for COVID-1919 Donation. The sender addresses are likely to be from compromised email accounts, with some from what appear to be a legal firm or similarly trustworthy sources such as a Christian school.
 
The email informs the recipient that their account has been credited for the COVID-19_19 donation and that the payment confirmation page is attached. A link to this page is provided, titled Promocode_fe33e, along with a PDF image.

Unsuspecting recipients who click on the link to view the page are led, not to a PDF file, but an HTML page hosted on getcloudapp.com with its background blurred.

A message appears at the front of this page, titled Account Payable Shared A File With You. A file labelled Remittance Advice is included, along with a link to download the file.

Clicking on the button titled Open currently leads to an error page.

"This is a particularly sinister scam as cybercriminals are attempting to exploit users who may be suffering from financial difficulties as a result of the economic uncertainty caused by the COVID-19, MailGuard says.

"Scammers are well-aware that many individuals and businesses are currently in desperate need of economic assistance. Cruelly, these attackers are capitalising on this hardship to steal even more from those who are already suffering."

Ways this email scam has attempted to exploit users, according to MailGuard:

• The use of a subject line like See COVID-1919 relief payment that has been paid. This creates intrigue among recipients, or even excitement among those who are actually expecting financial assistance. This may motivate them to click on the link without pausing to check for the emails legitimacy.
• The sender address implies the email is from a legal firm, Christian school or similar respected institutions. This isnt unexpected and is plausible that a notice of this nature may be sent with a COVID-19 relief notification, thereby not raising any alarm bells.

Despite these techniques, eagle-eyed recipients of this email would be able to spot several red flags that point to the email being a fraud, MailGuard says. These include the fact that the email does not address the recipient directly, and that the link included in the email does not actually open a PDF, as implied. Several grammatical errors like in few working days and spelling errors (COVID-19_19) are also red flags that this email is, in fact, not legitimate.

"The practice of launching cyberattacks that are centred around ongoing trends isn't anything new. Cybercriminals have long employed these tactics to take advantage of any disruptions and vulnerabilities in the hope that users uncertainties and fear around new changes will get better of them and they will not pause to check for the legitimacy of these emails," says MailGuard.

"Coronavirus-themed cyberattacks are designed to play with human psychology and emotions, like this one we intercepted a few weeks ago. As such, we strongly advise being extra vigilant when you receive emails such as these and lookout for any tell-tale signs that might be suspicious."

As a precaution, MailGuard urges you not to click links within emails that:

• Are not addressed to you by name.
• Appear to be from a legitimate company but use poor English or omit personal details that a legitimate sender would include.
• Are from businesses that you were not expecting to hear from.
• Take you to a landing page or website that is not the legitimate URL of the company the email is purporting to be sent from.