The latest trend in COVID-related phishing attacks, explored by email security provider Tessian, has seen scammers and threat actors asking users to download their ‘proof of vaccination’ or vaccine certificates.
Analysis of emails related to ‘proof of vaccination’ scams over the past six months revealed that a majority of scams in the UK saw attackers impersonate the NHS, in the aim to trick targets into believing the messages are legitimate.
These emails regularly contain official logos, use accurate display names, and correct spellings to look as real as possible.
Additionally, cyber criminals commonly used urgent-looking subject lines that include “IMPORTANT” and “OFFICIAL”, before acknowledging repercussions, such as an inability to travel or requirement to quarantine if instructions are not followed.
These tactics aim to prompt rushed action on the part of the victim before they can think about the email’s legitimacy, or the consequences of complying with the request.
Targets of the scams are then directed to a site designed to trick them into entering sensitive information such as personal details, credit card or banking details, in order to receive their proof of vaccination.
Why email is still the most significant vector that attackers exploit
“Throughout the pandemic, we’ve seen cyber criminals leverage COVID-related trends as lures in their phishing campaigns. Now they’re capitalising on the uncertainty surrounding vaccination certificates to dupe people into sharing login credentials and personal or financial information,” said Charles Brook, threat intelligence researcher at Tessian.
“In many cases, the emails purporting to come from the NHS look very convincing. Detecting these scams requires everyone to question messages they receive via phone, text or email.
“If you are unsure whether a text or email is a scam, then assume it is. Avoid clicking any links or attachments, or handing over any information until the sender has been verified. And remember, the NHS won’t charge you for a COVID NHS pass, so any email asking for payment details should be deleted. If you have further questions, go to the official NHS or gov.uk website.”
More information about Tessian’s latest research into COVID proof of vaccination scams can be found here.
