COVID-19 scam sites pass quarter of a million

The first quarter of this year has seen a massive growth in phishing and counterfeit pages, with around a third of them related to COVID-19.

A new report from fraud prevention company Bolster shows that it detected 854,441 confirmed phishing and counterfeit pages and four million suspicious pages, with more than a quarter of a million devoted to COVID-19.

Over 3,142 phishing and counterfeit pages went live every day in January, with that number increasing to 8,342 in March. Over 25,000 pages were created on March 19th, a record for the quarter.

"In all of our years of cybersecurity experience across the founding team, we have never seen a topical phishing spike this big before," says Shashi Prakash, co-founder and chief scientist at Bolster. "The wave of phishing is historically large, but it's still a wave like any other. Scammers and hackers are always looking for the latest lure to use to trick regular people into parting with their sensitive information."

Stimulus payments are a particular target for scammers, the report shows over 145,000 suspicious domain registrations with 'stimulus check' in them. The number of websites that claim to offer small business loans also jumped 130 percent from February to March. Hackers spun up 60,707 banking websites to attempt to siphon off stimulus funds.

Bolster has also discovered multiple phishing websites peddling fake COVID-19 cryptocurrencies and crypto wallets that aim to siphon data for future phishing, targeted malware, or credential stealing.

"The sudden leap to remote work as the new normal increases the surface area for online fraud and phishing attacks," adds Prakash. "Workers are spending more time online and learning new remote business processes for the first time. With anything new comes confusion. Businesses need to clear up the confusion through education. There needs to be a renewed focus on phishing awareness education, specifically how phishing relates to remote work. By keeping phishing prevention top of mind for all employees, businesses can mitigate the impact of phishing on their remote workforce."

Service providers can improve their handling of this wave by building two-way relationships with detection/takedown companies, extending API access to top take down vendors, or establishing an organizational priority to be the most phishing-free hosting provider.

You can see the full report on the Bolster site.

Image Cedit: karen roach/Shutterstock