Loading story…
Cybercriminals rapidly adopted coronavirus as a global social-engineering lure, using pandemic-themed emails to drive business email compromise, credential phishing, malware delivery, and large-scale spam across multiple countries and sectors. Proofpoint reported campaigns targeting organizations in Italy, the Czech Republic, the United States, Canada, Australia, and Turkey, as well as industries including healthcare, education, manufacturing, media, advertising, and hospitality. Attackers frequently impersonated trusted public-health institutions such as the WHO, CDC, and national health agencies to make messages appear legitimate and increase click-through rates.
The activity included highly tailored phishing against healthcare firms, fake employee surveys designed to steal OWA credentials, and region-specific lures written in local languages, including Italian. Proofpoint linked portions of the activity to known threat actors including TA505, TA542, and TA564, and observed malware families such as Ostap, The Trick banker, Get2, SDBbot, Ursnif, GuLoader, Agent Tesla, and Remcos. The report found that coronavirus had become a near-universal pretext for cybercrime, enabling both opportunistic and targeted attacks at global scale.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
By March 18, 2020, Proofpoint described coronavirus as a near-universal social-engineering lure across global cybercrime campaigns. The company reported abuse of trusted brands such as the WHO and CDC and documented targeting across multiple countries, languages, and industries.
On March 16, 2020, Proofpoint observed an email campaign impersonating the Philippines customs agency. The campaign delivered Remcos RAT to various international companies.
Also on March 10, 2020, Proofpoint observed a campaign spoofing the Public Health Agency of Canada and targeting Canadian users described as parents and guardians. A macro-enabled Word document installed the Ursnif banker, and Proofpoint attributed the activity to TA564.
On March 10, 2020, Proofpoint observed thousands of coronavirus-themed emails primarily targeting pharmaceutical and manufacturing companies in the United States. The malicious Excel attachment executed the Get2 loader, and Proofpoint attributed the campaign to TA505.
A campaign observed on March 5, 2020 used an attachment named COVID 19_List_cities_names.xlam and attempted to exploit Equation Editor vulnerabilities. The exploit chain downloaded GuLoader, which then delivered Agent Tesla.
In March 2020, attackers targeted users in Italy and the Czech Republic with malicious Word macro documents posing as updates from local medical professionals and the WHO. The documents dropped the Ostap JavaScript downloader, which then downloaded the red5 variant of The Trick banker.
In early March 2020, Proofpoint observed a small spam campaign targeting U.S. media and advertising companies to promote coronavirusmedicalkit[.]com. The site advertised free COVID-19 testing kits but added a $10 fee at the end of the ordering process.
On February 26, 2020, Proofpoint observed an Italian-language credential phishing campaign targeting users in Italy. The landing page used coronavirus-themed graphics to lure victims.
Proofpoint researchers tracked attackers leveraging coronavirus themes across cybercrime activity starting on January 29, 2020. The activity included business email compromise, credential phishing, malware delivery, and spam campaigns.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors widely exploited COVID-19 news, relief programs, testing, and vaccine demand to increase the effectiveness of phishing and malware campaigns, while mostly reusing established malware and infrastructure. Microsoft reported an eleven-fold jump in COVID-19-themed attacks after the disease was formally named, but said these campaigns remained a small share of overall activity and largely repurposed existing tradecraft. Palo Alto Networks tracked **69,950** pandemic-related phishing URLs from early 2020 through early 2021, including a **530%** rise in vaccine-themed phishing and a **189%** increase in pharmacy- and hospital-related lures, with many pages harvesting Microsoft 365, Outlook, and webmail credentials or personal and financial data from newly created and compromised sites. The same social-engineering theme was used to deliver a broad mix of malware across desktop and mobile platforms. Researchers linked COVID-19 spam and fake sites to loaders and commodity malware including **GuLoader**, **Parallax RAT**, **Remcos**, **Agent Tesla**, **NanoCore**, **NetWire**, **AzorUlt**, **FormBook**, **TrickBot**, and **MetaMorfo**, often relying on malicious attachments, macro-enabled Office files, or exploits such as `CVE-2017-11882`; Microsoft and others warned users not to enable macros in untrusted documents. More disruptive campaigns included **Netwalker** ransomware delivered through a `CORONAVIRUS_COVID-19.vbs` attachment, Android fraud via the **Ginp** trojan’s fake “Coronavirus Finder,” an Android **SLocker** variant that locked devices with COVID-19-themed ransom messages, and later low-volume phishing that used WHO-themed documents to install **Nerbian RAT** with anti-analysis and persistence features.
Aug 15, 2026
Malicious actors launched **COVID-19-themed phishing campaigns** against government agencies and medical organizations, using pandemic-related lures to exploit heightened public concern and operational urgency. The activity was documented by Palo Alto Networks Unit 42, which reported that attackers tailored messages around coronavirus developments to increase the likelihood that recipients would open emails, click links, or interact with malicious attachments. The targeting of public-sector and healthcare entities highlighted the risk that threat actors would use a global health crisis to gain access to sensitive networks and data. By impersonating trusted pandemic-related communications and leveraging the demand for timely information, the campaigns sought to compromise organizations that were already under significant pressure responding to the outbreak.
Jul 12, 2026
Threat researchers reported multiple **COVID-19-themed phishing campaigns** distributing the **RedLine Stealer** malware by disguising payloads as legitimate pandemic-related software and information. In one campaign, attackers used an `Omicron Stats.exe` lure tied to the Omicron outbreak; in another, they impersonated a coronavirus research effort and pushed a fake **Folding@home** application named `foldingathomeapp.exe`. Researchers assessed email as the likely delivery vector, with the campaigns exploiting public anxiety and curiosity around the pandemic to drive downloads. Once executed, RedLine harvested **browser credentials, cookies, credit card and autocomplete data, cryptocurrency wallet artifacts, Telegram and Discord data, and detailed host information**. Fortinet said the Omicron-themed sample copied itself into the victim’s roaming `AppData` directory, established persistence through a scheduled task, and communicated with a command-and-control server at `207.32.217.89:14588` using a distinctive authorization header; Proofpoint and BleepingComputer also noted RedLine receives remote tasking after infection. Victims were observed across at least **12 countries**, indicating broad opportunistic targeting rather than a narrowly focused operation.
Aug 15, 2026