Received: from (helo=example.com)by XXXXX.XXXXXX.XXX with esmtps(TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.92)
(envelope-from <[email protected]>) id 1jGoHM-0003JI-MJ for [email protected]; Tue, 24 Mar 2020 19:27:58 +0100 From: "World Health Organization" <[email protected]> To: <[email protected]> Subject: COVID-19 Solidarity Response Fund for WHO - DONATE NOW Message-ID: <xxxxxxxxxxx.xxxxxxxxxx@> Date: Tue, 24 Mar 2020 19:27:52 +0100 |

In the next example, the hackers masquerade as a pharmacy. Again, if you look at the “From” address, you’ll see the domain name isn’t associated with a legitimate sender. The email leads users to believe they’re clicking on a link that will take them to the pharmacy’s website. However, hovering over the link shows it’s not a secure URL and will take users to the phisher’s landing page instead.

In our final example, the hackers use the urgency of maintaining business continuity to get users to purchase a Wi-Fi booster. Again, the domain in the “From” field is spoofed and the link is unsecured. Clicking on the link will take users to a landing page that may look like a legitimate site. As users enter their personal data—like their credit card information—bad actors gain access to their personal data, enabling them to inflict more damage.

Some of the recent top phishing subjects include:
- Avoid contamination and take a fast accurate temperture without
- Stay Safe and take a temperture
- USA: Anti-Virus & Flu Face Mask Flying Off Shelves
- Don’t Go To Public Places Without This Face Mask
- High Quality Face Mask Everyone in The USA is Talking About
- Can Wearing a Face Mask Protect You From Catching a Virus?
A few tips for users to help verify the legitimacy of emails:
- Always check the domain name in the email “From” field. Is it coming from the organization or recipient it says?
- When hovering over links in emails, verify it directs to secured URLs (“https”—not “http”). Jumbled text in the links is an indication of an unsecure link.
- Review the content. Is it creating a sense of urgency for you to act? Are there spelling mistakes or incorrect grammar like in the examples above?
- Finally, look out for malicious email attachments. Check the file first by saving it to your downloads folder. If you’re using Windows, set your folder options to “show known file types” so you can view the file extension (e.g. the three letters at the end of the file name). Unzip the .zip file from your downloads and view the file extension. If it contains any of the following: .JS, .EXE, .COM, .PIF, .SCR, .HTA, .vbs, .wsf, .jse, or .jar at the end of the file name it’s malicious. You should not click on it or try to open it.
True protection comes with practicing a combination of strong security programs and awareness. Maintaining a culture of security and educating users on the different types of attacks and their damaging consequences should be a key part of your overall security strategy.
Mia Thompson is product marketing manager, Mail Assure at SolarWinds MSP. Read more SolarWinds MSP guest blogs here.