New Covid-19 Phish Abuses Tax Relief Act to Steal Credentials

Microsoft 365 EOP

By Ashley Atkins, Cofense Phishing Defense Center

For the past few months, the Cofense Phishing Defense Center (PDC) has observed numerous phishing campaigns associated with the coronavirus (COVID-19) pandemic.  These COVID-19-themed phish come in various forms and tend to prey on those fearful of contracting the disease as well as those who are in dire need of economic relief. Recently, the PDC identified a unique version that deserves an overview.

For this attack the user received a malicious email impersonating the US Department of Revenue with the subject: CARES Relief Certificate. The message body references information regarding the 2019 185 Act that has received attention in media outlets and social platforms. Upon researching the Act, it is highly likely the attacker copied that information from a website, made minor changes and created this phishing email, as seen in Figure 1 below.

Figure 1: Email Body

At a glance, this email simply informs users of the tax provisions adopted from the CARES Relief Act and outlines the details regarding it. It also mentions a deadline for applying, and that in order to apply users must fill out an attached secure document. One thing to note, this email arrived a few days after the stated deadline in the email. This may be intentional on the threat actor’s part in order to instill a sense of urgency in users – “you’re late and the deadline has passed!” However, some users may be pressed enough to attempt to apply, thinking it is worth a shot if it could mean receiving relief during this pandemic.

Many obvious red flags are present in this email. Besides the unsightly format, grammatical errors and random property address, the most evident red flag is the sender’s address. The attacker has abused AWeber’s email marketing service. AWeber’s use of SenderID authentication results in the “From” line showing as “Department of Revenue <state=lrs-gov[.]tk[@]send[.]aweber[.]com> on behalf of Department Of Revenue <state[@]lrs-gov[.]tk>”. When reviewing the domain, it seems to read as “Irs” (IRS), but the first letter is actually a lower-case L. The use of the .tk top-level domain (TLD) is worth noting as well. This TLD is the country code for a New Zealand territory called Tokelau. It is also free and one of the top TLDs used in phishing attacks.

Should users go so far as to download and open the “secure” HTML attachment, they are presented with a typically formatted Microsoft login page. This may appear odd, as the threat actor has impersonated a well-known and trusted entity such as the US Department of Revenue.

The fake Microsoft login page prompts for the standard username and password.

Figure 2: Phishing Page

Once credentials are submitted, a PHP script sends the stolen information to the attacker. The HTML’s source code attempts to bypass URL detection by using base tags that splits the malicious URLs into two sections.

Figures 3- 5: Source Code

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.The Cofense^® and PhishMe^® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.