Cybercriminals are using US President Donald Trump’s recent coronavirus diagnosis to launch a phishing campaign. The attack works by luring unsuspecting victims into downloading a malicious document by claiming to have the latest information on the president’s health.
The US presidential election between Trump and Biden entered new territory last week when it was revealed that Trump had contracted COVID-19. The contest, which already promises to be one of the most partisan in living memory, has elicited fervent reactions from both Republicans and Democrats alike.
The sheer level of interest in the election, and Trump’s diagnosis, has provided fertile ground for cyberattackers, who use the intrigue to tempt victims into clicking on suspicious email links.
- Protect your devices online with the best antivirus software
- What is phishing and how dangerous is it?
- This new 'linkless' phishing scam is even tricking tech experts
Gone phishing
Evidence suggests that the new phishing campaign makes use of the BazaLoader trojan, believed to have been created by notorious malware supplier, the TrickBot gang. According to cybersecurity firm Proofpoint, once downloaded, BazaLoader enables attackers to remotely access the victim’s device and even compromise others on the same network.
“This campaign attempted to spread unknown malware via BazaLoader, a first stage downloader initially observed earlier this year,” Sherrod DeGrippo, senior director of Threat Intelligence at Proofpoint, explained.
“Proofpoint researchers have previously observed BazaLoader being distributed in high volume email campaigns by a threat actor that is primarily known to distribute TrickBot. From a mitigation standpoint we recommend organizations use a secure email gateway that features an effective antimalware program, to help ensure these types of threats don’t make it to users’ inboxes.”
High-profile public events always draw the attention of cyberattackers and November’s US presidential election is certainly no exception. Earlier this month, researchers discovered malicious emails offering volunteering opportunities with the Democratic Party that were actually part of an Emotet malware campaign.
- Also check out our roundup of the best email services around
