{"id":44311,"date":"2021-12-08T00:25:41","date_gmt":"2021-12-08T00:25:41","guid":{"rendered":"http:\/\/4b5f1e63-54f0-4631-9ff9-1399918d608d"},"modified":"2021-12-08T00:25:41","modified_gmt":"2021-12-08T00:25:41","slug":"hackers-using-concern-about-omicron-strain-of-covid-19-to-attack-us-universities","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/hackers-using-concern-about-omicron-strain-of-covid-19-to-attack-us-universities\/","title":{"rendered":"Hackers using concern about Omicron strain of COVID-19 to attack US universities"},"content":{"rendered":"

Researchers with cybersecurity firm Proofpoint have discovered<\/a> a new phishing attack leveraging concern about the spread of the Omicron strain of COVID-19 to steal credentials and gain access to accounts at several prominent universities in the US. <\/p>\n

The emails — part of an attack that Proofpoint researchers said began in October but increased in November — generally contain information about COVID-19 testing and the new Omicron variant.<\/p>\n

Cybercriminals and threat actors have used concern about COVID-19<\/a> as a phishing lure since the pandemic began to cause headlines in January and February of 2020.  <\/p>\n

But with this specific attack, cybercriminals are spoofing the login portals of schools like Vanderbilt University, the University of Central Missouri and more. Some mimic generic Office 365 login portals while others use legitimate-looking university pages.<\/p>\n

“It is likely this activity will increase in the next two months as colleges and universities provide and require testing for students, faculty, and other workers traveling to and from campus during and after the holiday season, and as the Omicron variant emerges more widely,” the Proofpoint researchers wrote. <\/p>\n

“We expect more threat actors will adopt COVID-19 themes given the introduction of the Omicron variant. This assessment is based on previously published research that identified COVID-19 themes making a resurgence in email campaigns following the emergence of the Delta variant in August 2021.”<\/p>\n

In some cases, Proofpoint found that the emails actually redirected potential victims to the actual websites of their university after their credentials are stolen. The emails typically come with subject lines like “Attention Required – Information Regarding COVID-19 Omicron Variant – November 29.” Others are tagged with “COVID test.”<\/p>\n

\"screen-shot-2021-12-02-at-12-42-55-pm-0.png\"<\/span>