This article was submitted by Helio Pereira, Do you want to share knowledge with the other followers of MenosFios? Follow the steps.
Although it is one of the oldest and most frequent scams on the Internet, the practice of Phishing remains a significant problem for users and organizations, making up 70% of the attacks most used by cyber criminals, having increased significantly since the emergence of the coronavirus pandemic (COVID-19).
According to the information security researcher who is enrolled in the Twitter with name Dusty Fresh started tracking some of those domains that are using the name of the pandemic. According to a list that the researcher shared on his social network, more than 3.600 new domains containing the term “coronavirus” were created between 14 and 18 March 2020.
Another survey by RiskIQ San Francisco-based cybersecurity company, experts observed more than 13.500 suspicious domains on March 15, 2020 and more than 35.000 domains on March 16, 2020.
Legal Notice: Not every domain on the list published by DustyFresh is malicious. This is just a list of domain names that appear to be related to COVID-19.
O Phishing it occurs through the sending of electronic messages in which the cyber criminal tries to impersonate official information from a known institution (WHO, Banking Institutions, Ministry of Health) or known websites, to obtain credentials, personal or financial data of a user.
Different from Phishing traditional, in which the criminal does not know his victim, there is the spear phishing, which is a targeted attack, where the cyber criminal knows his victim or specific organization. The attack is fully customized to increase the likelihood of the victim falling in the blow. There are several detection and prevention measures to prevent the attack from being successful, and measures to mitigate the impact if the attack is successful.
Detection Measures
Cybercriminals create false urgencies about a particular subject in order to draw attention to the victim, spread messages that seem extremely urgent, such as: Urgent messages about your bank account, Credit Card, Registration Update, Promotions, bonuses, and impersonating a friend who needs money.
In the case of "Spear Phishing" ou Phishing targeted, legitimate requests for money or requests to verify credentials by email are very common. Of course, any message that asks you to download a file should be automatically suspected.
Preventive measures
- Think before you click;
- Activate double authentication factor;
- Do not open the e-mail attachment if you do not recognize the sender, always check the extension of the attachment;
- Never click on an attachment with the extension “pif","exe","Beat“,“.vbs";
- Never give out personal information;
- Use antivirus software;
- Keep your browser updated;
- Do not open other Internet browser sessions and access other websites while conducting financial transactions / inquiries online;
- Banks and financial institutions do not request your personal or account information by email, consult the relevant organization in case of doubt;
- Always ensure that your computer or smartphone is always up to date.
Responsive Measures
- Change your password immediately if you suspect that you have been Phishing;
- Enable the double factor of authentication in your accounts (WhatsApp, LinkedIn, Twitter, Instagram, Facebook, Hotmail, gmail);
- Check the status of your account frequently, in case of anomaly contact the responsible organization and / or inform the police immediately;
- Avoid spreading or spreading fake news.
