Since the end of February, phishing emails have spiked by over 600% as cyber attackers look to capitalize on the stress and uncertainty generated by the Covid-19 pandemic.
The attackers behind these malicious emails typically pose as a trusted organization or a legitimate source (i.e., World Health Organization (WHO), the Centers for Disease Controls (CDC), government agencies, banks, coworkers, etc.) who claim to have information regarding Covid-19 such as the latest statistics, advice for staying healthy, refunds for event cancellations, and information regarding government support packages and stimulus checks. If successful, these types of attacks can compromise credentials, personal and corporate data, and critical systems and open the door to a wide array of corporate fraud.
Covid-19 has already forced many organizations to quickly transition to a fully remote workforce, which has created new security and privacy risks. Since anyone can be a target for a Covid-19-tailored attack, it is important to ensure your employees are prepared to recognize these phishing schemes.
Below, we’ve created an email template that you can download, customize, and send to your teams to inform them about common attack methods during this time, your company’s preventative measures, and what they can do to protect themselves and the company.
Focal Point also offers a library of generic (non Covid-19) cybersecurity awareness email templates for use.
*Please note that any [BRACKETED] text is meant to be replaced with your company-specific information.
Covid-19 Phishing Awareness Email Template
Dear Team,
As you know, we are taking preventative measures against the Covid-19 pandemic and have adopted many new work habits. Unfortunately, cyber criminals are using Covid-19 and the changes surrounding it as a way to compromise credentials and steal critical information. We expect these tactics to continue for some time.
A common method of attack is phishing. A phishing email will claim to have information about Covid-19, but is actually a malicious attempt to get you to share information like login credentials, credit card information, or bank account details.
Although we maintain controls to help protect our networks and systems from cyber threats, we want to make sure you are taking extra precautions to spot and stop these attacks.
Coronavirus-themed phishing emails can take many different forms, including:
- Government Alert Emails: These are fraudulent emails disguised as government announcements from agencies like the CDC and WHO. These emails often appear legitimate, and may contain information about new policies in your area or methods for getting tested.
- Health Advice Emails: These emails exploit fears of infection and offer medical advice, inviting you to download attachments for secret cures, extra safety measures, and the ability to purchase protective gear.
- Workplace Policy Emails: Malicious attackers are targeting workplace email accounts leveraging the authority of HR departments. These emails will claim that there are new, important company policies to review, or mandatory updates that you’ll need to implement on your devices right away.
It is important to note that these are only a few email templates that cyber criminals are using to gain your information – please be on the lookout for others!
What You Can Do
We need your help to keep [COMPANY NAME] secure. Please observe the following email best practices:
- Be skeptical of emails from people claiming to work for government agencies – these agencies will never ask for personal information (i.e., social security number) through an email.
- If asked for corporate financial information (e.g., paying an invoice, transferring money, etc.), always validate the sender’s identity by following [COMPANY POLICY].
- Verify the authenticity of charitable organizations and requests for donations before giving any financial or credit card information.
- Do not respond to unsolicited communications about Covid-19 vaccinations or treatments.
- Be critical of messages that instill a sense of fear or demand immediate action related to Covid-19.
- Do not click links or download attachments from unknown or unexpected senders – hovering over the email address or link will reveal where the link actually goes.
- Do not reveal any personal or financial information online, especially in regard to a stimulus payment or business relief package.
- Get information about government actions regarding Covid-19 from reputable sources like the CDC and WHO websites.
If you are concerned that an email is part of a phishing campaign, please [COMPANY PROTOCOL].
We’re all operating under uncertain conditions, so we thank you for our cooperation in helping to keep our keep our network, and our people, safe from these cyber threats.
Please let us know if you have any questions.
Regards,
[NAME]
If you want more information on how to protect your remote workforce during this pandemic, check out our toolkit filled with helpful guides, checklists, webinars, and tips for tackling your toughest challenges.
