1. Covid Data Spreadsheet Scam
Last week, Microsoft warned about a phishing attack that looks like it is from Johns Hopkins University and has an Excel attachment. The spreadsheet claims to have stats and graphs about the number of coronavirus deaths in America. If you open the attachment and click on ‘Enable Content,’ it will download software that allows cybercriminals to take over your computer and steal confidential information.
The campaign began on May 12 and has been described as “massive.” Several hundreds of unique Excel files have been used, but they all result in the same malicious download. Further complicating matters, the remote access tool being used is legitimate; it is the macros in the Excel sheet that are malicious.
You may think that months into the pandemic these scams would be less effective, but they are still going strong.
How can you avoid falling for this?
- Remember to always be suspicious of unsolicited attachments. If the content is of interest to you, then go to the source. Johns Hopkins shares a wealth of information on their website that you can access and has publicly stated that they do not send attachments in their daily reports.
- Ask your IT team to scan suspicious emails and/or attachments. You don’t have to figure it all out on your own. If you can’t tell whether something might be dangerous, have your professionals test it just to be safe.
2. Scams Targeting the Unemployed
New job scams are doing the rounds, preying on people who may be recently unemployed or need to find remote work for various reasons (lack of childcare or public transportation, etc.).
One of these offers five thousand dollars a month working as a personal assistant. It sounds like a great deal and potentially plausible, being on call to run errands and do personal chores for busy executives, but it is actually a scam run by criminals that will try to use their victims for money laundering.
The scam works by establishing trust through a series of typical errands. Then the remote worker is asked to move funds or conduct transactions, not realizing that they involve stolen money. The remote worker has just been made a money mule. And the FBI points out that even doing so unknowingly is criminal behavior, punishable by law.
Another employment scam arrives through SMS, or text. It advertises an immediate job opening with a link to the information. The link goes to a spoofed employment or staffing site where personal information is required in order to apply for the job. Victims of this scam have provided their social security number, date of birth, and address before finding out the truth.
Stay safe with these tips:
- While remote work has been steadily increasing in popularity, you should still be suspicious of unsolicited emails or texts advertising such positions. Unless they come from a headhunter you know, they are typically a widespread scam to either steal your personal information or make you an unknowing accomplice.
- Keep in mind that urgency is a tactic used by scammers to get you to click without thinking or doing research. And if an offer seems too good to be true, it usually is.
- Take the time to check a company’s website and call or email their HR department before filling out information for a job. It’s true that not all positions are posted publicly, but if there is a real opportunity, you should be able to speak to a real person about it.
3. Contact-Tracing Scam
Another SMS or texting scam to look out for centers on pandemic contact-tracing. As of the end of May, this scam has been reported primarily in the UK, but experts expect it to spread globally as contact-tracing apps roll out across the world.
Contact-tracing is designed to notify people when someone they have interacted with tests positive or shows symptoms, so that person can take preventive measures and/or get tested. Some apps have already come out to help share this information, and more are being tested.
The scam works by appearing to be a text from one of these apps, saying someone you know is at risk and it is recommended that you get tested or self-isolate. The message includes a link for you to enter your personal information to supposedly confirm the contact and then help notify others you have been in contact with. However, your personal information is really used to gain access to bank accounts and steal from you.
So how can you protect yourself?
- Stay vigilant. Scammers will always try to take advantage of emergencies when people are worried and fearful and not always thinking clearly. Do not click on a link in an unsolicited message.
- If the message includes information about the app, try to confirm independently that it is legitimate. If you worry it might be true, contact your local health center without interacting with the message link. They can discuss symptoms and risk with you, and you can arrange a test if necessary.
