With the malicious emails, seeking to exploit a major health concern for financial gain, if users elect to accept or decline the invitation to schedule their vaccination, those receiving the fake emails are then directed to series of pages requesting sensitive information (requesting such data as name, address, mother’s maiden name, credit card number and banking information). This is a scam to collect personally identifiable information.
The fake emails come with an email address “noreply@nhs.gov.uk” (the real NHS domain is nhs.uk). The messages contain statements like: “IMPORTANT – Public Health Message| Decide whether if you want to be vaccinated” (as reported by Bleeping Computer).
noreply@nhs.gov.uk (the real NHS domain is nhs.uk) and use mail subject similar to “IMPORTANT – Public Health Message| Decide whether if you want to be vaccinated.”
The issue prompted Pauline Smith, head of Action Fraud, to tell the BBC: “It’s despicable that fraudsters will take advantage of such an important tool in the fight against this evil and deadly disease.”
Looking at this scandal for Digital Journal is Casey Ellis, CTO and Founder of Bugcrowd. Ellis explains that this breach of ethics has increased safety concerns around cybersecurity within the government and healthcare organizations. This is especially in relation to the COVID vaccine distribution efforts.
According to Ellis: “The critical importance and widespread uncertainty around the COVID-19 vaccine put the global spotlight on government and healthcare organizations involved in distribution efforts. As the world waits with bated breath, the anticipation and anxiety around the subject of vaccination make it especially useful as a phishing lure for attackers who target unsuspecting citizens.”
Looking at the specific incident, Ellis adds: “This was most recently demonstrated by the ongoing phishing attack linked to the UK’s National Health Service (NHS). The NHS phish was a serious attempt – It used the pretext of existing NHS vaccinations campaigns, included “credible jargon” and NHS design mimicry to appear as legitimate as possible, and exploited loss-aversion through a fake “use it or lose it” message.”
