By Kian Maher
On February 6, a large earthquake swept through regions of Turkey and Syria resulting in thousands of casualties in both countries. Since then, humanitarian aid and assistance has poured in from countries across the world to save the lives of people trapped under damaged buildings and bring much needed supplies to survivors.
In conjunction with this event, a large number of personal donations have been called for by large multi-national organizations, such as the Red Cross, to assist in relief efforts. Unfortunately, people with less charitable ambitions have decided to exploit the resulting outflow of support for this tragedy and deceive people's good will to make a quick profit.
In the example seen below, the Cofense Phishing Defense Center (PDC) has begun seeing these donation scams appearing in our client’s inboxes.
Figure 1: Initial Email
These emails contain language intended to manipulate emotions and obtain a donation from a well-meaning person who may believe it is a legitimate charity. Appearing simple and generally benign it is an email that in most cases a person would quickly scan before moving on to the rest of their inbox, however, the subject line and main body contents make use of kind wording and sentiment to catch the users’ eye and eventually direct them toward the attached PDF.
Figure 2: Donation PDF
Figure 2 shows the contents of the PDF file attached in the email. We find more content relating to the earthquake itself and a plea to donate to their organization. Seen at the bottom are 3 QR codes for cryptocurrency wallets to which donations can be made. These wallets currently sit empty with 0 noted transactions, as seen in figures 3 and 4, however as these campaigns are generally quick to set up and easy to deploy, it is usually only a matter of time before someone is tricked into sending money.
Figure 3: Ethereum Wallet
Figure 4: Bitcoin Wallet
With recent calls by multiple organizations across the world for personal fundraising we expect to see these scams increase in prevalence as uncertainty and lack of direction take hold in these first few weeks. We urge users to be vigilant and ensure with full certainty that any donations are being made to legitimate organizations.