threatpost.com
Open in
urlscan Pro
35.173.160.135
Public Scan
Submitted URL: https://threatpost.com/omicron-phishing-scam-uk/176771/#respond'
Effective URL: https://threatpost.com/omicron-phishing-scam-uk/176771/
Submission: On December 08 via api from US — Scanned from DE
Effective URL: https://threatpost.com/omicron-phishing-scam-uk/176771/
Submission: On December 08 via api from US — Scanned from DE
Form analysis 4 forms found in the DOM
POST /omicron-phishing-scam-uk/176771/#gf_5
<form method="post" enctype="multipart/form-data" target="gform_ajax_frame_5" id="gform_5" action="/omicron-phishing-scam-uk/176771/#gf_5">
<div class="gform_body">
<ul id="gform_fields_5" class="gform_fields top_label form_sublabel_below description_below">
<li id="field_5_8" class="gfield field_sublabel_below field_description_below gfield_visibility_visible"><label class="gfield_label" for="input_5_8"></label>
<div class="ginput_container ginput_container_text"><input name="input_8" id="input_5_8" type="text" value="" class="medium" placeholder="Your name" aria-invalid="false"></div>
</li>
<li id="field_5_1" class="gfield gfield_contains_required field_sublabel_below field_description_below gfield_visibility_visible"><label class="gfield_label" for="input_5_1"><span class="gfield_required">*</span></label>
<div class="ginput_container ginput_container_email">
<input name="input_1" id="input_5_1" type="text" value="" class="medium" placeholder="Your e-mail address" aria-required="true" aria-invalid="false">
</div>
</li>
<li id="field_5_9" class="gfield js-kaspersky-gform-recaptcha-placeholder gform_hidden field_sublabel_below field_description_below gfield_visibility_hidden"><input name="input_9" id="input_5_9" type="hidden" class="gform_hidden"
aria-invalid="false" value=""></li>
<li id="field_5_2" class="gfield input-without-label label-gdpr gfield_contains_required field_sublabel_below field_description_below gfield_visibility_visible"><label class="gfield_label"><span class="gfield_required">*</span></label>
<div class="ginput_container ginput_container_checkbox">
<ul class="gfield_checkbox" id="input_5_2">
<li class="gchoice_5_2_1">
<input name="input_2.1" type="checkbox" value="I agree" id="choice_5_2_1">
<label for="choice_5_2_1" id="label_5_2_1">I agree to my personal data being stored and used to receive the newsletter</label>
</li>
</ul>
</div>
</li>
<li id="field_5_5" class="gfield input-without-label label-gdpr gfield_contains_required field_sublabel_below field_description_below gfield_visibility_visible"><label class="gfield_label"><span class="gfield_required">*</span></label>
<div class="ginput_container ginput_container_checkbox">
<ul class="gfield_checkbox" id="input_5_5">
<li class="gchoice_5_5_1">
<input name="input_5.1" type="checkbox" value="I agree" id="choice_5_5_1">
<label for="choice_5_5_1" id="label_5_5_1">I agree to accept information and occasional commercial offers from Threatpost partners</label>
</li>
</ul>
</div>
</li>
<li id="field_5_10" class="gfield gform_validation_container field_sublabel_below field_description_below gfield_visibility_visible"><label class="gfield_label" for="input_5_10">Phone</label>
<div class="ginput_container"><input name="input_10" id="input_5_10" type="text" value=""></div>
<div class="gfield_description" id="gfield_description__10">This field is for validation purposes and should be left unchanged.</div>
</li>
</ul>
</div>
<div class="gform_footer top_label"> <input type="submit" id="gform_submit_button_5" class="gform_button button" value="Subscribe" onclick="if(window["gf_submitting_5"]){return false;} window["gf_submitting_5"]=true; "
onkeypress="if( event.keyCode == 13 ){ if(window["gf_submitting_5"]){return false;} window["gf_submitting_5"]=true; jQuery("#gform_5").trigger("submit",[true]); }" style="display: none;"> <input
type="hidden" name="gform_ajax" value="form_id=5&title=&description=&tabindex=0">
<input type="hidden" class="gform_hidden" name="is_submit_5" value="1">
<input type="hidden" class="gform_hidden" name="gform_submit" value="5">
<input type="hidden" class="gform_hidden" name="gform_unique_id" value="">
<input type="hidden" class="gform_hidden" name="state_5" value="WyJbXSIsImIwODQwZTA2ZGQ0NzYwODcyOTBkZjNmZDM1NDk2Y2ZkIl0=">
<input type="hidden" class="gform_hidden" name="gform_target_page_number_5" id="gform_target_page_number_5" value="0">
<input type="hidden" class="gform_hidden" name="gform_source_page_number_5" id="gform_source_page_number_5" value="1">
<input type="hidden" name="gform_field_values" value="">
</div>
</form>GET https://threatpost.com/
<form class="c-site-search__form" role="search" method="get" action="https://threatpost.com/">
<input type="text" class="c-site-search__field" name="s" placeholder="Search">
<button type="submit" class="c-button c-button--secondary c-button--smaller c-site-search__button" value="Search"><svg class="icon fill">
<use xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg#icon-search"></use>
</svg> Search</button>
<div class="c-site-search__overlay"></div>
</form>POST https://threatpost.com/wp-comments-post.php
<form action="https://threatpost.com/wp-comments-post.php" method="post" id="commentform" class="comment-form">
<div class="o-row">
<div class="o-col-12@md">
<div class="c-form-element"><textarea id="comment" name="comment" cols="45" rows="8" aria-required="true" placeholder="Write a reply..."></textarea></div>
</div>
</div>
<div class="o-row">
<div class="o-col-6@md">
<div class="c-form-element"><input id="author" name="author" placeholder="Your name" type="text" value="" size="30"></div>
</div>
<div class="o-col-6@md">
<div class="c-form-element"><input id="email" name="email" placeholder="Your email" type="text" value="" size="30"></div>
</div>
</div>
<p class="form-submit"><input name="submit" type="submit" id="submit" class="c-button c-button--primary" value="Send Comment"> <input type="hidden" name="comment_post_ID" value="176771" id="comment_post_ID">
<input type="hidden" name="comment_parent" id="comment_parent" value="0">
</p>
<p style="display: none;"><input type="hidden" id="akismet_comment_nonce" name="akismet_comment_nonce" value="aec6163ada"></p><!-- the following input field has been added by the Honeypot Comments plugin to thwart spambots -->
<input type="hidden" id="lOPZLgmBwue7nWVyFAs5QPqaN" name="Zh3NkYwruyR63NJhZOmHwF5Fx">
<script type="text/javascript">
document.addEventListener("input", function(event) {
if (!event.target.closest("#comment")) return;
var captchaContainer = null;
captchaContainer = grecaptcha.render("recaptcha-submit-btn-area", {
"sitekey": "6LfsdrAaAAAAAMVKgei6k0EaDBTgmKv6ZQrG7aEs",
"theme": "standard"
});
});
</script>
<script src="https://www.google.com/recaptcha/api.js?hl=en&render=explicit" async="" defer=""></script>
<div id="recaptcha-submit-btn-area"> </div>
<noscript>
<style type="text/css">
#form-submit-save {
display: none;
}
</style>
<input name="submit" type="submit" id="submit-alt" tabindex="6" value="Submit Comment">
</noscript><textarea name="ak_hp_textarea" cols="45" rows="8" maxlength="100" style="display: none !important;"></textarea><input type="hidden" id="ak_js" name="ak_js" value="1638924005912">
</form>GET https://threatpost.com/
<form class="c-site-search__form" role="search" method="get" action="https://threatpost.com/">
<input type="text" class="c-site-search__field" name="s" placeholder="Search">
<button type="submit" class="c-button c-button--secondary c-button--smaller c-site-search__button" value="Search"><svg class="icon fill">
<use xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg#icon-search"></use>
</svg> Search</button>
<div class="c-site-search__overlay"></div>
</form>Text Content
Newsletter
SUBSCRIBE TO OUR THREATPOST TODAY NEWSLETTER
Join thousands of people who receive the latest breaking cybersecurity news
every day.
The administrator of your personal data will be Threatpost, Inc., 500 Unicorn
Park, Woburn, MA 01801. Detailed information on the processing of personal data
can be found in the privacy policy. In addition, you will find them in the
message confirming the subscription to the newsletter.
*
* *
*
* *
* I agree to my personal data being stored and used to receive the
newsletter
* *
* I agree to accept information and occasional commercial offers from
Threatpost partners
* Phone
This field is for validation purposes and should be left unchanged.
This iframe contains the logic required to handle Ajax powered Gravity Forms.
The administrator of your personal data will be Threatpost, Inc., 500 Unicorn
Park, Woburn, MA 01801. Detailed information on the processing of personal data
can be found in the privacy policy. In addition, you will find them in the
message confirming the subscription to the newsletter.
Threatpost
* Cloud Security
* Malware
* Vulnerabilities
* InfoSec Insiders
* Webinars
*
*
*
*
*
*
*
Search
* What Are Your Top Cloud Security Challenges? Threatpost PollPrevious article
* Pandemic-Influenced Car Shopping: Just Use the Manufacturer APINext article
OMICRON PHISHING SCAM ALREADY SPOTTED IN UK
Author: Becky Bracken
December 3, 2021 2:46 pm
3 minute read
Write a comment
Share this article:
*
*
Omicron COVID-19 variant anxiety inspires new phishing scam offering fake NHS
tests to steal data.
The global pandemic has provided cover for all sorts of phishing scams over the
past couple of years, and the rise in alarm over the spread of the latest
COVID-19 variant, Omicron, is no exception.
As public health professionals across the globe grapple with what they fear
could be an even more dangerous COVID-19 variant than Delta, threat actors have
grabbed the opportunity to turn uncertainty into cash.
U.K. consumer watchdog “Which?” has raised the alarm that a new phishing scam,
doctored up to look like official communications from the National Health
Service (NHS), is targeting people with fraud offers for free PCR tests for the
COVID-19 Omicron variant.
The Centers for Disease Control (CDC) and the World Health Organization WHO)
list Omicron as a “variant of concern” of the COVID-19 virus, and warned this
week that it’s spreading rapidly around the world. Public-health officials
aren’t sure yet how effective current vaccines and other mitigation strategies
will be against the mutation, according to CBS News.
Once again, global pandemic distress has presented an opportunity for scammers.
OMICRON ANXIETY FUELS SCAM
Sent by text, email and even offered over the phone, threat actors are
contacting people across the U.K. offering them what they say are new test kits
specifically designed to detect the Omicron variant.
“NHS scientists have warned that the new Covid [sic] variant Omicron spreads
rapidly, can be transmitted between fully vaccinated people, and makes jabs less
effective,” one phishing email discovered by Which? read. “However, as the new
covid [sic] variant (Omicron) has quickly become apparent, we have had to make
new test kits as the new variant appears dormant in the original tests.”
Besides giving false information, the email is littered with grammatical errors.
But, should a victim click on the link at the bottom of the correspondence, it
takes the person to a fake NHS page that asks for full name, date of birth,
address, phone numbers and email address.
In addition to harvesting personally identifiable information (PII), the site
also asks for a £1.24 as a delivery fee and mother’s maiden name, giving the
scammers access to the target’s banking information as well.
This, and other pandemic-related phishing campaigns, rely on the victim’s
anxiety to cause them overlook obvious signs of fraud.
“Phishing attacks and other scams often exploit emotions to get people to react
quickly and without thinking things through,” Erich Kron, security awareness
advocate at KnowBe4, told Threatpost. “This new COVID-19 variant has some
significant emotional weight for people who are tired of lockdowns and the
continuing impact of the pandemic, making it a powerful tool to get people to
click.”
The watchdog has submitted its findings to the National Cyber Security Centre
(NCSC), but warned that other similar Omicron bait is likely to surface over the
next several weeks — so consumers should be on alert.
COVID-19 PHISHING FRENZY
Last year, when COVID-19 vaccines began rolling out, one analysis from Barracuda
Networks found between October 2020 and last January, the average number of
vaccine-themed spear phishing attacks grew by 26 percent.
By May, the U.S. Attorney’s Office and the Department of Homeland Security shut
down a scam site targeting immigrant communities with vaccine-related phishing
scams.
Besides vaccine lures, the pandemic has inspired spear-phishing campaigns
offering fake COVID-19 relief checks and even job opportunities for those left
unemployed by widespread shutdowns. Even people who held onto their jobs were
targeted once they returned to work, with scam emails purporting to offer new
office COVID-19 protocols. They instead stole their login credentials.
Users should be cautious about almost any unsolicited communication relating to
COVID-19. Anyone who received one of these scam Omicron PCR test emails is
advised by Which? to forward it via report websites to the NCSC.
There’s a sea of unstructured data on the internet relating to the latest
security threats. REGISTER TODAY to learn key concepts of natural language
processing (NLP) and how to use it to navigate the data ocean and add context to
cybersecurity threats (without being an expert!). This LIVE, interactive
Threatpost Town Hall, sponsored by Rapid 7, will feature security researchers
Erick Galinkin of Rapid7 and Izzy Lazerson of IntSights (a Rapid7 company), plus
Threatpost journalist and webinar host, Becky Bracken.
Register NOW for the LIVE event!
Write a comment
Share this article:
* Web Security
SUGGESTED ARTICLES
WINDOWS 10 DRIVE-BY RCE TRIGGERED BY DEFAULT URI HANDLER
There’s an argument injection weakness in the Windows 10/11 default handler,
researchers said: an issue that Microsoft has only partially fixed.
December 7, 2021
WHEN SCAMMERS GET SCAMMED, THEY TAKE IT TO CYBERCRIME COURT
Underground arbitration system settles disputes between cybercriminals.
December 7, 2021
GOOGLE TAKES DOWN GLUPTEBA BOTNET; FILES LAWSUIT AGAINST OPERATORS
The malware’s unique blockchain-enabled backup C2 scheme makes it difficult to
eliminate completely.
December 7, 2021
DISCUSSION
LEAVE A COMMENT CANCEL REPLY
This site uses Akismet to reduce spam. Learn how your comment data is processed.
INFOSEC INSIDER
* ARE YOU GUILTY OF THESE 8 NETWORK-SECURITY BAD PRACTICES?
December 6, 2021
* PANDEMIC-INFLUENCED CAR SHOPPING: JUST USE THE MANUFACTURER API
December 3, 2021
* HOW DECRYPTION OF NETWORK TRAFFIC CAN IMPROVE SECURITY
November 30, 2021
3
* HOW TO DEFEND AGAINST MOBILE APP IMPERSONATION
November 23, 2021
* ONLINE MERCHANTS: PREVENT FRAUDSTERS FROM BECOMING HOLIDAY GRINCHES
November 22, 2021
Newsletter
SUBSCRIBE TO THREATPOST TODAY
Join thousands of people who receive the latest breaking cybersecurity news
every day.
Subscribe now
Twitter
We want to know what your biggest #cloudsec concerns and challenges are, and how
your company is dealing with them.… https://t.co/0b77PkNxFi
4 hours ago
Follow @threatpost
NEXT 00:02 01:10 360p 720p HD 1080p HD Auto (360p) About Connatix V141495 Closed
Captions About Connatix V141495 1/1 Skip Ad Continue watching after the ad Visit
Advertiser website GO TO PAGE
SUBSCRIBE TO OUR NEWSLETTER, THREATPOST TODAY!
Get the latest breaking news delivered daily to your inbox.
Subscribe now
Threatpost
The First Stop For Security News
* Home
* About Us
* Contact Us
* Advertise With Us
* RSS Feeds
* Copyright © 2021 Threatpost
* Privacy Policy
* Terms and Conditions
* Advertise
*
*
*
*
*
*
*
TOPICS
* Black Hat
* Breaking News
* Cloud Security
* Critical Infrastructure
* Cryptography
* Facebook
* Government
* Hacks
* IoT
* Malware
* Mobile Security
* Podcasts
* Privacy
* RSAC
* Security Analyst Summit
* Videos
* Vulnerabilities
* Web Security
Threatpost
*
*
*
*
*
*
*
TOPICS
* Cloud Security
* Malware
* Vulnerabilities
* Privacy
Show all
* Black Hat
* Critical Infrastructure
* Cryptography
* Facebook
* Featured
* Government
* Hacks
* IoT
* Mobile Security
* Podcasts
* RSAC
* Security Analyst Summit
* Slideshow
* Videos
* Web Security
AUTHORS
* Tara Seals
* Tom Spring
* Lisa Vaas
THREATPOST
* Home
* About Us
* Contact Us
* Advertise With Us
* RSS Feeds
Search
*
*
*
*
*
*
*
InfoSec Insider
INFOSEC INSIDER POST
Infosec Insider content is written by a trusted community of Threatpost
cybersecurity subject matter experts. Each contribution has a goal of bringing a
unique voice to important cybersecurity topics. Content strives to be of the
highest quality, objective and non-commercial.
Sponsored
SPONSORED CONTENT
Sponsored Content is paid for by an advertiser. Sponsored content is written and
edited by members of our sponsor community. This content creates an opportunity
for a sponsor to provide insight and commentary from their point-of-view
directly to the Threatpost audience. The Threatpost editorial team does not
participate in the writing or editing of Sponsored Content.
We use cookies to make your experience of our websites better. By using and
further navigating this website you accept this. Detailed information about the
use of cookies on this website is available by clicking on more information.
ACCEPT AND CLOSE