{"id":90765,"date":"2020-03-20T08:00:54","date_gmt":"2020-03-20T15:00:54","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/?p=90765"},"modified":"2025-06-26T22:40:05","modified_gmt":"2025-06-27T05:40:05","slug":"protecting-against-coronavirus-themed-phishing-attacks","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/03\/20\/protecting-against-coronavirus-themed-phishing-attacks\/","title":{"rendered":"Protecting against coronavirus themed phishing attacks"},"content":{"rendered":"\n

The world has changed in unprecedented ways in the last several weeks due to the coronavirus pandemic. While it has brought out the best in humanity in many ways, as with any crisis it can also attract the worst in some. Cybercriminals use people\u2019s fear and need for information in phishing attacks to steal sensitive information or spread malware for profit. Even as some criminal groups claim they\u2019ll stop attacking healthcare and nursing homes<\/a>, the reality is they can\u2019t fully control how malware spreads.<\/p>\n\n\n\n

While phishing and other email attacks are indeed happening, the volume of malicious emails mentioning the coronavirus is very small. Still, customers are asking us what Microsoft is doing to help protect them from these types of attacks, and what they can do to better protect themselves. We thought this would be a useful time to recap how our automated detection and signal-sharing works to protect customers (with a specific recent example) as well as share some best practices you can use personally to stay safe from phishing attempts.<\/p>\n\n\n\n

What Microsoft is doing<\/h2>\n\n\n\n

First, 91 percent of all cyberattacks start with email. That\u2019s why the first line of defense is doing everything we can to block malicious emails from reaching you in the first place. A multi-layered defense system that includes machine learning, detonation, and signal-sharing is key in our ability to quickly find and shut down email attacks.<\/p>\n\n\n\n

If any of these mechanisms detect a malicious email, URL, or attachment, the message is blocked and does not make its way to your inbox. All attachments and links are detonated (opened in isolated virtual machines). Machine learning, anomaly analyzers, and heuristics are used to detect malicious behavior. Human security analysts continuously evaluate user-submitted reports of suspicious mail to provide additional insights and train machine learning models.<\/p>\n\n\n\n

Once a file or URL is identified as malicious, the information is shared with other services such as Microsoft Defender Advanced Threat Protection (ATP) to ensure endpoint detection benefits from email detection, and vice versa.<\/p>\n\n\n\n

An interesting example of this in action occurred earlier this month, when an attacker launched a spear-phishing campaign that lasted less than 30 minutes.<\/p>\n\n\n\n

Attackers crafted an email designed to look like a legitimate supply chain risk report for food coloring additives with an update based on disruptions due to coronavirus. The attachment, however, was malicious and delivered a sophisticated, multi-layer payload based on the Lokibot trojan (Trojan:Win32\/Lokibot.GJ!MTB).<\/p>\n\n\n\n

\"Screenshot<\/a><\/figure>\n\n\n\n

Had this payload been successfully deployed, hackers could have used it to steal credentials for other systems\u2014in this case FTP accounts and passwords\u2014which could then be used for further attacks.<\/p>\n\n\n\n

Only 135 customer tenants were targeted, with a spray of 2,047 malicious messages, but no customers were impacted by the attack. The Office 365 ATP detonation service, signal-sharing across services, and human analysts worked together to stop it.<\/p>\n\n\n\n

And thanks to signal sharing across services, customers not using a Microsoft email service like Office 365, hosted Exchange, or Outlook.com, but using a Windows PC with Microsoft Defender enabled, were fully protected. When a user attempted to open the malicious attachment from their non-Microsoft email service, Microsoft Defender kicked in, querying its cloud-based machine learning models and found that the attachment was blocked based on a previous Office 365 ATP cloud detection. The attachment was prevented from executing on the PC and the customer was protected.<\/p>\n\n\n\n

What you can do<\/h2>\n\n\n\n

While bad actors are attempting to capitalize on the COVID-19 crisis, they are using the same tactics they always do. You should be especially vigilant now to take steps to protect yourself.<\/p>\n\n\n\n

Make sure your devices have the latest security updates installed and an antivirus or anti-malware service. For Windows 10 devices, Microsoft Defender Antivirus is a free built-in service enabled through Settings. Turn on cloud-delivered protection and automatic sample submission to enable artificial intelligence (AI) and machine learning to quickly identify and stop new and unknown threats.<\/p>\n\n\n\n

Enable the protection features of your email service. If you have Office 365, you can learn about Exchange Online Protection here<\/a> and Office 365 ATP here<\/a>.<\/p>\n\n\n\n

Use multi-factor authentication (MFA) on all your accounts. Most online services now provide a way to use your mobile device or other methods to protect your accounts in this way. Here\u2019s information on how to use Microsoft Authenticator<\/a> and other guidance on this approach<\/a>.<\/p>\n\n\n\n

MFA support is available as part of the Azure Active Directory (Azure AD) Free offering. Learn more here<\/a>.<\/p>\n\n\n\n

Educate yourself, friends, and colleagues on how to recognize phishing attempts and report suspected encounters. Here are some of the tell-tale signs.<\/p>\n\n\n\n