Beware! Govt warns of massive attacks on stealing sensitive data from today; may use 'COVID-19' as bait

Such emails could come from different fake email ids created by malicious actors impersonating various authorities. People could receive emails from ids such as ncov2019@gov.in and the attack campaign could start from today, June 21


The government has warned people about suspicious phishing attacks, which if disclosed "official information on COVID-19" could steal all your information, including bank account and debit or credit card details. This phishing attack will start from today, so people are advised to be extra careful before such emails. The dangerous players are plotting attacks on major fraud cases against Indian people and businesses, including small, medium and large enterprises, said the Indian Computer Emergency Response Team of the Ministry of Information and Information Technology.

The phishing campaign to steal sensitive information is expected to use malicious emails under the auspices of local authorities responsible for disseminating COVID-19 state-sponsored sponsorship programs. "Such emails are designed to redirect recipients to fake websites where they are deceived into opening malicious files or entering personal and financial information," the ministry said in a statement.

This phishing campaign is designed to make government institutions, departments and trade unions dedicated to overseeing the distribution of government funding programs. "The perpetrators claim to have 2 million IDs or emails and plan to send emails entitled" COVID-19 free trial to all residents of Delhi, Mumbai, Hyderabad, Chennai and Ahmedabad, to persuade them to provide personal information, " said the government.

Emails like this can come from various fake email emails created by malicious actors to pretend to be different managers. People can receive emails on ids such as "ncov2019@gov.in" and attacks, the campaign can start from today, June 21.

What you can do if you receive malicious email

• Don't open attachments in unsolicited emails, even if they come from people in your contact list and never click on a URL contained in an unsolicited email, even if the link seems benign. If it seems a genuine URL, close the email and go to the organisation's website directly through the browser and check if such information is given there.
• Leverage Pretty  Good Privacy in mail communications. Additionally, advise the users to encrypt or protect the sensitive documents stored on the internet-facing mechanics to avoid potential leakage.
• Exercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be known.
• Scan for and remove suspicious e-mail attachments; ensure the scanned attachment is its "true file type" (i.e. the extension matches the file header).
• Beware about phishing domain, spelling errors in emails, websites and unfamiliar email senders.
• Check the integrity of URLs before providing logging credentials or clicking a link.
• Don't submit personal information to unknown and unfamiliar websites.
• Consider using safe browsing tools, filtering tools in your anti-virus, firewall and filtering services.
• update spam filters with latest spam mail contents.
• Any unusual activity or attack should be reported immediately at @cert-in.org.in