Cofense Logo - Email Security Solutions

Coronavirus-Themed Phish Continue to Surge

Share Now


By Max Gannon

Since our reporting on Coronavirus-themed phishing campaigns began, Cofense Intelligence has seen them surge, along with associated malware families. As more enterprises and government entities mandate remote work, threat actors stand to gain from using “work from home” or “Coronavirus” themed phishing emails. We recently explored this in a Flash Alert and Strategic Analysis that Cofense Intelligence customers received, highlighting the impersonation of trusted brands like Google Drive in complex campaigns and offering mitigation steps.

Primary Observed Trends

Over the past month, Cofense Intelligence has identified the following trends prevalent in COVID-19 themed phishing campaigns. Credential phishing campaigns have been the most common, though we have seen several malware families delivered as well.

Most Common Delivery Mechanisms:

  • Attached spreadsheet or Word document delivering a second-stage malware executable
  • Attached archived executable
  • Embedded URLs delivering ransomware
  • Office macros
  • CVE-2017-11882
      • Auto-IT Dropper (which exploits CVE-2017-1882)

Malware Delivered:

·       Agent Tesla Keylogger ·       Ave_Maria Stealer ·       Black RAT ·       FormGrabber
·       Hakbit Ransomware ·       Hawkeye Keylogger ·       KPOT Stealer ·       Lime RAT
·       Loki Bot ·       NanoCore ·       Nemty Ransomware ·       Pony
·       Remcos RAT ·       SalityBot ·       TrickBot

Commonly Spoofed Organization Types:

  • World Health Organization
  • Centers for Disease Control
  • Other global/regional health organizations
  • Health related non-profits/medical associations
  • Federal, State and Local Departments of Health/Ministries of Health
  • Transportation companies
  • Shipping companies

Many COVID-19 phishing templates have been more convincing than your average phish. In one example, seen in Figure 1 below, threat actors hosted the logo of the spoofed organization on Google Drive and added an additional threat at the end of the email: a whopping $1,000 fine if the supposedly attached forms to approve travel outside of the home are not filled out by the recipient. The attachment delivers the information stealer KPOT via a VBS script to AutoIT dropper. The dropper uses legitimate Windows utilities to disguise its actions.

Figure 1: Coronavirus-Themed Email Delivers Complex Chain

Phishing Threat Landscape Future Changes

Coronavirus themes have predictably grown in popularity and will almost certainly continue to do so. These phishing campaigns are also likely going to adapt over time to incorporate related work from home, teleconference or videoconference invites or notices, government refund, unemployment filing, and online ordering themes. Some threat actors have already begun to do this, as shown in Figure 2, where threat actors used a “Work Remotely Enrollment (Action Required)” subject, spoofing internal Human Resources to deliver links to credential phishing pages hosted on Microsoft SharePoint. Additional  Coronavirus phishing email examples that evade email gateways are available on the Cofense Coronavirus Phishing Information Center. This center is continually updated with campaigns identified by Cofense Intelligence, and the related IOCs are sent to our customers daily.

Figure 2: Example Email with Coronavirus “Work From Home” Related Theme

If COVID-19 continues to affect business operations, it is likely this will affect the phishing threat landscape more broadly. While many organizations continue to maintain some operations, there are likely to be some longer-term shifts in normal business communications.  For example, an email about an office party or an in-person meeting is more likely to make employees suspicious than it would have previously.

These kinds of changes will also likely extend to our personal lives as well in the “stay home” era. An email about new concert tickets or in-store sales will likely raise a red flag. Simply causing individuals to pause for a few extra seconds because something seems suspicious may not seem particularly monumental. However, when users briefly break out of their ordinary mindsets, they gain the opportunity to report a link rather than click a link—a key component of effective phishing reporting programs. Although, as noted above, threat actors will almost certainly adapt as well in their phishing templates.

As Coronavirus continues to affect everyone, there will likely be a significant shift in the phishing threat landscape for the most common malware and phishing themes, even excluding specifically Coronavirus-related themes. Although there has been a massive shift to remote work, some organizations have minimal remote operations infrastructure. In order to operate, they have no choice but to allow some users to connect to infrastructure with a lowered accepted standard of security. Organizational responses to suspicious network or user behavior may also be complicated due to these changes. Previously, such incidents of suspicious network or user behavior could be dealt with by physically quarantining the computer and quickly supplying a replacement as incident response teams investigate the issue. Currently, this may not be possible if the only way the employee can contact work-related support is via their potentially compromised computer. More laborious responses may delay investigations and mitigations.

These kinds of scenarios are what makes it ever more important for organizations to ensure phishing prevention is as much a focus as post-compromise detection. Incident response and mitigation will certainly be more difficult as long as workforces need to remain dispersed.

How Cofense Can Help

Visit Cofense’s Coronavirus Phishing Infocenter to stay up to date as threats evolve. Our site is updated with screenshots and YARA rules as we continue to track campaigns.

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.


We use our own and third-party cookies to enhance your experience by showing you relevant content, personalizing our communications with you, and remembering your preferences when you visit our website. We also use them to improve the overall performance of our site. You can learn more about the cookies and similar technology we use by viewing our privacy policy. By clicking ‘Accept,’ you acknowledge and consent to our use of all cookies on our website.

This site is registered on as a development site.