Hackers have found a new way to steal information by taking advantage of the 40 million Americans without jobs due to the Covid-19 pandemic. Thriving on the combined stress and social turmoil that has arisen from the largest mass unemployment since the Great Depression, hackers are relying on social engineering and phishing schemes to spoof CV’s.
WHAT IS PHISHING?
Phishing is a tactic used by hackers to fool users into thinking that an attacker is really a legitimate person or institution. The attacker uses this fake identity to gain access to a user’s private information (such as usernames, passwords, credit card info, ssn, etc.). Phishing scams are often in the form of emails with links to a malicious external site or malicious documents asking a user to download them. If a user downloads the suspicious files or click on a suspicious link, some form of malware is activated to perform a variety of harmful actions.
WHAT THE SCAM LOOKS LIKE
According to Phil Muncaster’s article on infosecurity-magazine.com, hackers are titling emails with the subject lines of “applying for job” or “regarding job” and including malicious .xls files that are Trojans (a type of malware that is disguised as a legitimate software or file). When executing these files, recently unemployed users are tricked into giving hackers access to their banking information. Attackers are also targeting the employee health sector by creating fake medical leave forms. Attacks luring administrative personnel from the US Family Medical Leave Act (FMLA) have occurred with staff opening malicious attachments.
HOW TO AVOID PHISHING SCHEMES
During these difficult times, it is even more necessary to consider the safety of your personal data, as well as the safety of yourself as a user. Attackers depend on manipulating emotions and using crises to perform social engineering schemes. Therefore, when receiving a “phishy” email, it is strongly recommended that you go through the following list of checks:
Does the person sending you an email seem unusual or suspicious?
If it is someone you do not know, then it is always good to be cautious. Ask around your circle and research them or their “organization” on the internet to find out if they are legitimate. If the sender is someone you supposedly know, check for any unusual behavior, remarks, or strange wording used that does not match the person you know in real life.
Does the email have a sense of urgency?
Hackers like to use urgency because they are more likely to get a reaction from a user. For example: If an attacker sends an email that a user’s account will be shut down if they do not send their username and password within the next 24 hours, then the user will feel panicked and fall victim to their attack.
Are there strange links, files, crazy subject lines, or attachments included in the email?
To get users to click on a message, attackers will use bold and eye catching subject lines (such as “CLICK HERE! YOU’VE WON!”) or subject lines with important sounding memos (such as “Vital Meeting For Your Career”). If you also see suspicious files asking you to download them or hyperlinks that you are unsure of where they lead to, it is best to report the email and delete it.
CONCLUSION
For closing remarks, remember never to click on any links or open any files that seem suspicious. Go with your gut. If there’s something “phishy” about a message, then there’s no need to act upon it.
Comments