PUBLISHED 3/12/2020

Current events are worrisome enough without having to be on the lookout for cybercriminals (and just plain bad actors) taking advantage of concerns over the spread of COVID-19. Yet, we must continue to be vigilant.

Hackers have always been quick to respond to tragic events and crises fueled by fear. When massive fires, tornadoes, earthquakes, or tsunamis occur and care agencies reach out via social media to solicit charitable donations, the hacker community is also there with their look-alike phishing emails that beckon the user to “click here,” thus transporting the generous and unwary donor to a site that steals credentials, plants malware, or both.

In the last month, we have seen the rise of such activities as the public’s need for information overwhelms their good sense to not “click here.” Wired magazine ran with a story on January 31, 2020, and reporting that the security firm Mimecast had picked up emails with malicious links and attached PDFs claiming to contain information on how to protect yourself from the virus.

Here’s one such example of a phishing email, spotted by the Sophos Security Team, which added the “fake” label in the lower righthand corner, just to make sure the public knew that this did not come from the WHO:

As reported by Pierluigi Paganini on March 12, 2020, another example comes from an app that purports to be a map showing the locations of the COVID-19 outbreak. Once the user downloads the app, it appears to be from a trusted source (in this case, the data and map are from Johns Hopkins), but the malware runs in the background while the hapless user views the data:

So, please continue to be careful with any suspicious email, instead of looking for information through website links or search for apps to download, go to trusted news sources—not social media—and government websites, such as the site maintained by the Centers for Disease Control at https://www.cdc.gov/ or the World Health Organization at https://www.who.int/.

Authored by: Claudia Rast, Shareholder & Chair of IP, Cybersecurity & Emerging Technology Group at Butzel Long

Please note: These resources have been prepared by Michigan Community Resources with assistance from pro bono attorneys throughout Michigan as information only and does not constitute legal advice.  This information is not intended to create and receipt of the information does not constitute a client-lawyer relationship.