Coronavirus-Themed Phishing and Malware Campaigns Surge Worldwide

Cybercriminals rapidly adopted coronavirus as a global social-engineering lure, using pandemic-themed emails to drive business email compromise, credential phishing, malware delivery, and large-scale spam across multiple countries and sectors. Proofpoint reported campaigns targeting organizations in Italy, the Czech Republic, the United States, Canada, Australia, and Turkey, as well as industries including healthcare, education, manufacturing, media, advertising, and hospitality. Attackers frequently impersonated trusted public-health institutions such as the WHO, CDC, and national health agencies to make messages appear legitimate and increase click-through rates.

The activity included highly tailored phishing against healthcare firms, fake employee surveys designed to steal OWA credentials, and region-specific lures written in local languages, including Italian. Proofpoint linked portions of the activity to known threat actors including TA505, TA542, and TA564, and observed malware families such as Ostap, The Trick banker, Get2, SDBbot, Ursnif, GuLoader, Agent Tesla, and Remcos. The report found that coronavirus had become a near-universal pretext for cybercrime, enabling both opportunistic and targeted attacks at global scale.