Spam in Q2: Fraudsters Spread Fake Tax-Refund Packed with Malware

Woburn, MA-August 28, 2019 - During the second quarter of 2019, Kaspersky reported a 21% increase in the amount phishing attacks compared to Q2 of 2018. According to the spam and phishing report, experts also detected multiple mailshots pretending to offer tax refunds worldwide. Being that this period is traditionally used as a deadline for filing tax returns and refunds in many countries, criminals were using this scheme to steal valuable information, or in some cases, install dangerous spyware.

Quarterly spam and phishing mailshots often exploit seasonal activities to strike victims harder than a typical phishing scheme. What’s more, in the case of temporary disguises, scammers can use one of the most effective social engineering techniques – giving a limited amount of time to act - justifying it with real-life circumstances, and therefore encouraging the victim to make spontaneous decisions.

The detected wave of tax refund fraud came under the guise of tax refund emails with short expiration dates. For instance, malefactors used fake major UK tax services to urge victims to follow the link and fill out the form immediately, while emails under the guise of the CRA (Canada Revenue Agency) were giving the recipient just 24 hours to respond, otherwise a tax refund would not be possible.

Example of the phishing page disguised as CRA tax refund form

In addition, some of the emails analyzed by Kaspersky experts included malicious attachments, disguised as a copy of the return form which in fact was either a malicious downloader, which would download more malicious programs onto users’ machines when launched, or a backdoor (multifunctional malware) that provided criminals with remote access to the infected machine. Its capabilities include monitoring keystrokes, stealing passwords for browsers and Windows accounts and recording video from the computer’s webcam. To convince users to launch such malicious file, fraudsters usually would make it look like a zip file containing important information for tax form updates.

“Seasonal spam and phishing can be extremely effective, since the emergence of such a letter in a mailbox is sometimes wished and expected, unlike most unique-offer type scams,” said Maria Vergelis, security researchers at Kaspersky. “Moreover, with phishing attacks, the tricked victim might not even realize that they were subjected to a cyberattack and had exposed their credentials or email until it is too late and they suffer from the consequences.”

Other key findings in the report include:

• The overall number of phishing attacks in the quarter rose by 21% compared to the figure a year ago, reaching 129,933,555
• In Q2 of 2019, the amount of spam peaked in May (58%). The average share of spam in the world’s email traffic was 55%, which is 5% higher than the average figure in the second quarter of 2018
• China (23.72%) became the most popular source of spam, overtaking the U.S. (13.89%) and Russia (4.83%)
• The country most targeted by malicious mailshots was Germany, once again with 10.05%. Russia came second (6.16%), followed by Vietnam (5.98%)

To avoid exposing personal information and being affected by malicious attachments, consumers are advised to:

• Always check the link address and sender’s email before clicking on any suspicious emails.
• Check if the link address can be seen in the email and is the same as the actual hyperlink (the real address the link will take you to). This can be checked by hovering your mouse over the link.
• Do not download and open email attachments that come from unfamiliar email addresses, before scanning them with a security solution. If the email seems legitimate, it is best to check it by accessing the website of the organization that supposedly sent it.
• Never share your sensitive data, such as logins and passwords, bank card data etc., with a third party. Official companies will never ask for data like this via email.
• Use a reliable security solution with behavior-based anti-phishing technologies, such as Kaspersky Total Security, to detect and block both spam and phishing attacks and initiation of malicious files.

Read the full text of the report on Securelist.com

About Kaspersky

Kaspersky is a global cybersecurity company founded in 1997. Kaspersky’s deep threat intelligence and security expertise is constantly transforming into innovative security solutions and services to protect businesses, critical infrastructure, governments and consumers around the globe. The company’s comprehensive security portfolio includes leading endpoint protection and a number of specialized security solutions and services to fight sophisticated and evolving digital threats. Over 400 million users are protected by Kaspersky technologies and we help 270,000 corporate clients protect what matters most to them. Learn more at www.kaspersky.com.

Media Contact
Gayle Landry
781-503-1800
Gayle.Landry@kaspersky.com