Hackers are targeting US universities with phishing emails that pretend to offer testing information about the COVID-19 Omicron variant, according to security researchers.
On Tuesday, security company Proofpoint warned about the phishing email campaign, which has been trying to steal login credentials from university staff and students.
The effort dates back to October, and has involved sending thousands of messages to dozens of universities in North America. In the past, the phishing emails mentioned COVID-19 testing for the Delta variant as a way to trick victims into giving up their login credentials. But late last month, the phishing emails pivoted to Omicron as the new strain made headlines.
For example, one of the messages from the phishing campaign had the subject line: “Attention Required - Information Regarding COVID-19 Omicron Variant - November 29.”
The email then offered a link to a seemingly legit login page from the university. But in reality, the login page was under the hackers’ control, and capable of capturing password information.
Proofpoint now warns: “It is likely this activity will increase in the next two months as colleges and universities provide and require testing for students, faculty, and other workers traveling to and from campus during and after the holiday season.”
Other emails from the campaign include attaching a COVID-19 test result with a link to a fake web page from the university. In some cases, the hackers will also try to steal the two-factor authentication codes for a victim’s account. This involves creating fake login pages intended to spoof multi-factor authentication providers such as Duo.
The phishing emails can also be tough for victims to spot. Proofpoint points out that sometimes the hackers will use previously hacked university accounts to send out the messages, making the emails seem official.
“It is likely the threat actors are stealing credentials from universities and using compromised mailboxes to send the same threats to other universities,” the company added. The ultimate goal and the actors behind the phishing campaign remain unknown.
To avoid getting phished, it's best to look at the web address for any login pages sent to you via email. If the URL deviates from the official web address to the domain or contains some oddity, then it's probably a scam. Check out out guide for more tips to stay safe.