Thread by @EFF

Unfortunately, COVID-19 has spurred an unprecedented number of online scams targeting people and businesses. However, they’re using methods that we’ve seen time and time again: (thread) washingtonpost.com/news/powerpost…

Many of these scams use “phishing” techniques (when an attacker sends a message, email, or link that looks innocent, but is actually malicious and designed to prey on fears about the virus). Common methods use: enticing offers, urgency, and pretending to be someone you recognize.

If an email sounds too good to be true (“New COVID-19 prevention and treatment information! FREE info”), it probably is. And if an email demands urgent action from you (“URGENT: ventilators delivery blocked. Please accept order.”), slow down and make sure it’s legitimate.

Keep in mind that legitimate sources of health information likely won’t use unsolicited email or text messages to make announcements.
Phishing emails such as this one expect readers to only see the display name without the email address beside it. Check where the message is from.

Some of these scams have the intent of stealing your password to log into a service you use, and some of them have the intent of installing malware. For more information, see our printable handout from SEC. sec.eff.org/uploads/upload…

Two trends in malware that we’re especially seeing in COVID-19 related phishing attacks are trojans and ransomware. Some phishing campaigns use a live interactive map of COVID-19 to appear valid and trustworthy even to a cautious eye.
blog.lookout.com/commercial-sur…

In general, ways to avoid accidentally downloading malware from a phishing message include:
✔️ check the sender’s address
✔️ try not to click or tap
✔️ try not to download files from unfamiliar people
✔️ phone a friend/coworker: ask "were we expecting an email from this sender?"

For more tips and examples of phishing messages, check out our blogpost on phishing in the time of COVID-19. eff.org/deeplinks/2020…