Phishing follows the news: coronavirus emails
Fake health warnings and “WHO” emails carrying malware are spreading as fast as the news. How to spot them.
Criminals always follow the headlines, and right now that’s the coronavirus outbreak. Security teams are seeing emails pretending to be health authorities, the World Health Organization or local governments, with “safety measures” attached as Word files or links to fake login pages.
Some carry Emotet. Others collect email passwords.
How to spot them:
- Health agencies don’t email you attachments out of the blue. They publish on their websites.
- Check the sender address, not the name. “WHO” from a random domain is fake.
- Never enable macros to read a “safety guide”.
- Get news from sources you choose: type the WHO or your health ministry’s address yourself.
For IT teams: warn staff now, and add a rule flagging external emails that mention the outbreak with attachments. This theme will keep going for a while.