COVID-19 Lures Drove Phishing, RAT Delivery, and Ransomware Campaigns

Threat actors widely exploited COVID-19 news, relief programs, testing, and vaccine demand to increase the effectiveness of phishing and malware campaigns, while mostly reusing established malware and infrastructure. Microsoft reported an eleven-fold jump in COVID-19-themed attacks after the disease was formally named, but said these campaigns remained a small share of overall activity and largely repurposed existing tradecraft. Palo Alto Networks tracked 69,950 pandemic-related phishing URLs from early 2020 through early 2021, including a 530% rise in vaccine-themed phishing and a 189% increase in pharmacy- and hospital-related lures, with many pages harvesting Microsoft 365, Outlook, and webmail credentials or personal and financial data from newly created and compromised sites.

The same social-engineering theme was used to deliver a broad mix of malware across desktop and mobile platforms. Researchers linked COVID-19 spam and fake sites to loaders and commodity malware including GuLoader, Parallax RAT, Remcos, Agent Tesla, NanoCore, NetWire, AzorUlt, FormBook, TrickBot, and MetaMorfo, often relying on malicious attachments, macro-enabled Office files, or exploits such as CVE-2017-11882; Microsoft and others warned users not to enable macros in untrusted documents. More disruptive campaigns included Netwalker ransomware delivered through a CORONAVIRUS_COVID-19.vbs attachment, Android fraud via the Ginp trojan’s fake “Coronavirus Finder,” an Android SLocker variant that locked devices with COVID-19-themed ransom messages, and later low-volume phishing that used WHO-themed documents to install Nerbian RAT with anti-analysis and persistence features.