Threat Actors Capitalize on Unemployment Fears

Summary

As the current pandemic has caused occupational loss and furloughs, cyber-criminals are capitalizing on unemployment concerns. One campaign currently circulating is a phishing email crafted to appear as a Zoom meeting invitation that requests the recipient to join for the purpose of “contract suspension” or “termination trial.” Additionally, the email claims that the meeting will begin momentarily, enticing the user to click without further scrutiny. If the link is clicked, the user is directed to a spoofed Zoom login page requesting the user’s “email” credentials. Once the credentials are entered, the user is redirected to a Zoom help page, and the credentials are sent to the threat actor. Another phishing campaign claims to be from an outsourced human resources contractor and requests recipients to view a fictitious payroll report that includes additional stimulus. The link is hosted on Google Docs and contains another link that, if clicked, downloads unknown malware. A third scam that has surfaced are employment ads offering teleworking opportunities. After the victim acquires an interview and is given an offer of employment, they are prompted to complete various forms, such as a W-9 and direct deposit. The scammer is then provided with all the details required to drain bank accounts and steal the victim’s identity.

Recommendations

The NJCCIC reminds users to exercise caution when opening unsolicited emails and confirm details via an alternate means of communication. Additionally, jobseekers are urged to research potential employers and businesses prior to providing sensitive information. Furthermore, we urge users to educate others of these and similar scams to avoid victimization.