Google compiles security tips to help avoid COVID‑19 scams

Earlier this month, Google revealed what coronavirus-related spam, malware, and phishing Gmail is blocking on a daily basis. The company today detailed online threats from government-backed groups, and provided security tips for avoiding COVID-19 scams.

The COVID-19 pandemic is being leveraged as “general bait” by nefarious parties. Examples range from fake charities and NGOs asking for donations to groups pretending to be employers with WFH-related communications. There are also websites masquerading as official government and public health agency pages.

Hackers frequently look at crises as an opportunity, and COVID-19 is no different. Across Google products, we’re seeing bad actors use COVID-related themes to create urgency so that people respond to phishing attacks and scams.

That said, Google interestingly reports that there is “no overall rise in phishing attacks by government-backed groups.” Parties are just changing tactics, with a slight decrease in Google warnings this March compared to the two previous months.

Google’s Threat Analysis Group today also revealed that “over a dozen government-backed attacker groups [are] using COVID-19 themes” for phishing and malware.

One notable campaign attempted to target personal accounts of US government employees with phishing lures using American fast food franchises and COVID-19 messaging. Some messages offered free meals and coupons in response to COVID-19, others suggested recipients visit sites disguised as online ordering and delivery options. Once people clicked on the emails, they were presented with phishing pages designed to trick them into providing their Google account credentials.

The company says its defenses are directly marking those messages as spam, while Safe Browsing warns users if they click the link. There are no reports of accounts being compromised.

Given an increase in health agencies being targeted, the company is “proactively adding extra security protections, such as higher thresholds for Google Account sign in and recovery, to more than 50,000 of such high-risk accounts.”

Meanwhile, Google has compiled security tips on how to avoid COVID-19 scams. It highlights five types of scams, including websites selling fraudulent products and fake financial offers. There’s also a useful printable infographic version.