“As phishing scams continue to climb during the COVID-19 pandemic, Singapore businesses should remain vigilant”, says James Forbes-May, Vice President, Barracuda, Asia-Pacific
As Singapore and the rest of the world continues to grapple with the new coronavirus, COVID-19, and how to handle it, attackers are taking advantage of the widespread discussion of COVID-19, using reCaptcha walls to lure unsuspecting users.
New research from Barracuda, a trusted partner and leading provider of cloud-enabled security solutions, shows a steady increase in the number of coronavirus COVID-19-related spear-phishing attacks since January, a trend which continues to gather speed as the pandemic continues, up a massive 667percent since the end of February.
Cashing in on intense public concern around COVID-19, as well as increased reliance on the Internet with millions of Singaporeans now working from home, cybercriminals are using a variety of coronavirus themed phishing campaigns to distribute malware, steal credentials, and scam users out of money.
Phishing campaigns are quickly becoming more sophisticated, with many now using reCaptcha walls to block URL scanning services from accessing the content of phishing pages.
The reCaptcha walls prevent email security systems from blocking phishing attacks and make the phishing site more believable in the eyes of the user.
Typically, ReCaptcha walls are used to verify human users before allowing access to web content. Scammers have begun using the Google-owned service to prevent automated URL analysis systems from accessing the actual content of phishing pages.
The research, published by Barracuda, showed that one phishing campaign had sent out more than 128,000 emails to various organisations and employees using reCaptcha walls to conceal fake Microsoft login pages.
The phishing emails indicated that the user has received a voicemail message. Once the reCaptcha was solved, the user was redirected to the actual phishing page, which spoofs the appearance of a common Microsoft login page. Any entered login information is sent straight to the cyber scammers, who will likely use this information to hack into the real Microsoft accounts.
“Singapore businesses need to be aware that this is a real threat and know that just because a website has a reCaptcha, that does not mean the page is safe, said James Forbes-May, Vice President, Barracuda, Asia-Pacific.
“As phishing scams continue to climb during the COVID-19 pandemic, Singapore businesses must remain vigilant. With more employees than ever before working from home, there’s never been a better time for employers to provide end-user training and spear-phishing simulation to educate employees on the essentials of staying protected against email-based phishing attacks. That means checking for suspicious senders, URLs, and attachments, and now, exercising scrutiny when seeing reCaptcha walls, especially in unexpected places where legitimate walls have not been encountered in the past.
“And while email protection solutions will definitely help in protecting against this type of attack, no security solution will catch everything, however creating the ‘human firewall’ to compliment your technology investment through enabling the ability of the users to spot suspicious emails and websites will continue to be the best business practice to improve protecting your organisation.”
