E-Business
Sophos Identifies Coronavirus Scam email, Lists Measures to Avoid it
Cybercrooks love a crisis, because it gives them a believable reason to contact you with a phishing scam, Sophos has said, as it alerts individuals and businesses on the Coronavirus “safety measures” email is a phishing scam.
Sophos evolves to meet every new challenge, protecting more than 400,000 organizations of all sizes in more than 150 countries from today’s most advanced cyber threats.
Powered by SophosLabs, its cloud-native and AI-enhanced solutions are able to adapt and evolve to secure endpoints and networks against never-before-seen cybercriminal tactics and techniques.
Sophos Security Team reported of the current scam that uses the coronavirus to lure unsuspecting businesses and people with the email which carries the logo of the World Health Organization and states:
.Go through the attached document on safety measures regarding the spreading of corona virus.
.Click on the button below to download
.Symptoms common symptoms include fever, coughcshortness of breath and breathing difficulties.
Sophos said that fortunately, at least for fluent speakers of English, the criminals have made numerous spelling and grammatical mistakes that act as warning signs that this is not what it seems.
“The link you’re asked to click on is similarly, and fortunately, dubious.
“Firstly, it seems to be a compromised music site with a weird name that doesn’t have any obvious connection to any well-known health organisation; secondly, it is an HTTP site, not an HTTPS site, which is sufficiently unusual these days to be suspicious in its own right.
“Nevertheless, the scam page itself is incredibly simple – it can’t have taken the crooks more than a few minutes to put together – and visually effective.
“The fake page consists of the official, current home page of the World Health Organisation (WHO) with an unassuming popup form on top of it.
“It doesn’t just look like the WHO’s page in the background, it is the WHO’s page, rendered in a frame that’s embedded in the fake site:
“You can see why someone who’s nervous about the coronavirus issue, or who has friends and family in the main areas of infection, or who wants to do the right thing by learning more about preventing the spread of the disease…
“…might fill in the form, perhaps because they are feeling pressurised by (or not thinking clearly because of) the subject matter.
“Indeed, many companies have already sent emails to their staff to offer advice, so reading additional information that is allegedly from the WHO sounds like a sensible and responsible thing to do.
“Of course, if you put in your email address or your password and click through, you’ll be submitting the filled-in web form to the crooks.
“Worse still, you’ll be submitting it over an unencrypted connection.
“So anyone else on the same network as you, for example in your hotel lobby or the coffee shop, could potentially capture your network traffic and see the username and password you just put in.
“Once you’ve clicked the [Verify] button, the crooks simply redirect you to the real WHO site at who DOT int, which looks just like the previous page you were on, minus the popup form…
“…with the rather obvious exception that the address bar now looks (and is) correct, displaying the genuine WHO website name, showing a padlock and – if you click through and view the web certificate – a certificate that shows up as issued to the WHO itself.
Sophos also offered measures on what to do about it:
Never let yourself feel pressured into clicking a link in an email. Most importantly, don’t act on advice you didn’t ask for and weren’t expecting. If you are genuinely seeking advice about the coronavirus, do your own research and make your own choice about where to look.
Don’t be taken in by the sender’s name. This scam says it’s from “World Health Organization”, but the sender can put any name they like in the From: field.
Look out for spelling and grammatical errors. Not all crooks make mistakes, but many do. Take the extra time to review messages for telltale signs that they’re fraudulent – it’s bad enough to get scammed at all without realising afterwards that you could have spotted the fraud up front.
Check the URL before you type it in or click a link. If the website you’re being sent to doesn’t look right, stay clear. Do your own research and make your own choice about where to look.
Never enter data that a website shouldn’t be asking for. There is no reason for a health awareness web page to ask for your email address, let alone your password. If in doubt, don’t give it out.
If you realise you just revealed your password to imposters, change it as soon as you can. The crooks who run phishing sites typically try out stolen passwords immediately (this process can often be done automatically), so the sooner you react, the more likely you will beat them to it.
Never use the same password on more than one site. Once crooks have a password, they will usually try it on every website where you might have an account, to see if they can get lucky.
Turn on two-factor authentication (2FA) if you can. Those six-digit codes that you receive on your phone or generate via an app are a minor inconvenience to you, but are usually a huge barrier for the crooks, because just knowing your password alone is not enough.
Nigeria Data Protection Commission (NDPC) has launched an investigation into allegations that the confidentiality and integrity of candidates’ personal data may have been compromised by hackers.
The Commission initiated the inquiry following concerns over possible data breaches during examinations.
Preliminary findings indicate that several examination centres may not have implemented adequate technical and organizational measures to safeguard candidates’ personal information, as required under data protection regulations.
Although the incident reportedly affected 379, 997 candidates, the NDPC’s investigation is poised to cover a systemic audit of data processing and third parties.
It will be recalled that JAMB recently admitted that a technical error on its platform affected a total of 379,997 candidates in 157 examination centres across Lagos and the South-East.
Further investigation led to the arrest of at least 20 suspects who are currently in the custody of the Department of State Services and the Nigerian Police Force.
Cyber security firm, Kaspersky, has once again warned that sophisticated cybercriminals increasingly target Africa as ransomware and advanced persistent threats (APTs) escalate across the region.
Speaking at the company’s annual Cyber Security Weekend for the Middle East, Turkiye and Africa (META) region, the cybersecurity firm’s Global Research and Analysis Team highlighted growing digital threats affecting African nations.
Kenya, Nigeria, and South Africa emerged as hotspots, with Kenya recording one of the highest web threat incident rates at 20.1% in first quarter 2025.
“While ransomware is less prevalent in Africa due to lower levels of digitisation and economic constraints, countries like South Africa and Nigeria are seeing a sharp rise in attacks,” said Sergey Lozhkin, head of META and APAC regions at Kaspersky.
Kaspersky noted a 0.01 percentage point increase in African ransomware cases year-on-year, reaching 0.41%, still below global and Middle Eastern averages, but a troubling sign for the continent’s emerging digital infrastructure.
Experts warned that attackers are refining their tactics, shifting focus to unconventional entry points like IoT devices, smart appliances, and misconfigured hardware.
“As these economies expand digitally, sectors such as manufacturing, finance and government are becoming key targets,” said Lozhkin
The cyber-crime landscape is evolving quickly, fuelled by AI tools and dark web access to large language models, which enable less skilled actors to launch convincing phishing and malware campaigns.
Groups like FunkSec, which uses AI-generated code and a low-cost ransom model, are redefining ransomware operations.
“African organisations face the dual challenge of expanding digital footprints and limited cybersecurity awareness. This makes layered defense strategies, including network segmentation, real-time monitoring and regular staff training, essential,” stated Lozhkin
Kaspersky continues to monitor 25 active APT groups in the META region, including SideWinder and MuddyWater, some of which are known to target African institutions.
To bolster defenses, the firm recommends using tools such as its free Anti-Ransomware Tool for Business and the Kaspersky Next suite for threat visibility and response.
Nigeria recently launched a new joint case team to step up its response to cybercrimes that affect people and businesses at home and abroad.
The ‘Joint Case Team on Cybercrime’ brings together Nigeria’s key justice and security agencies to work as one, making it easier to detect, investigate, and prosecute digital offences.
It is supported by the UK National Crime Agency, the UK Foreign, Commonwealth and Development Office, and the Commonwealth Secretariat, as part of a wider effort to promote international cooperation on cybercrime.
Speaking at the launch in Abuja, Prince Lateef Fagbemi SAN, minister of justice and attorney general of the federation described the initiative as “a bold and transformative stride in Nigeria’s justice system.”
He said that although Nigeria has a national legal framework to address cyber offences, laws alone are not enough.
Nigeria is among the countries most affected by cybercrime around the world, with increasing financial losses.
NDPC Probes Suspected Data Breach in Examination Centres
Airtel’s AI Spam Alert Flags 9.6m Spam Attempts
Vitel Wireless Completes Interconnectivity with all Major Telcos in Nigeria
Nigeria Approves $500m for AfDB’s Trust Fund Replenishment over Next 15 Years
Nigeria Among Hotspots as Kaspersky Warns of Rising Ransomware Threat in Africa
E-Business3 days agoNigeria Launches Cybercrime Team with Commonwealth, UK Support
Telecom3 days agoTelecom Subscribers Decline By 43m in One Year
Telecom3 days agoNCC Orders Telcos to Compensate Subscribers for Outages More than 24 Hours
E-Financial3 days agoSERAP Drags CBN to Court over Alleged Failure to Disclose LG Allocations
General News3 days agoHEDA Sues FG, Oil Giants over Alleged Unlawful Oil Licence Transfer
Telecom2 days agoEngr. Ikechukwu Nnamani Receives Two Prestigious @ABoICT Awards
E-Financial2 days agoEFCC Recovers over N20Bn Stolen by Hackers from 6 Banks in Nigeria
Telecom3 days agoIHS Nigeria, NSCDC Partner to Protect Telecoms Infrastructure