COVID-19 Phishing Attacks are Exposing Email Security’s Biggest Flaws

To those of us who work in cybersecurity, hackers and nation state adversaries exploiting the pandemic to drive fear and misunderstanding is certainly horrific, but not at all unexpected. To put the situation into perspective, Tech Republic reported on a 667% increase in malicious email attacks in just a 22-day span (March 1-23). According to the article, more than 2% of those 467,000 spear-phishing emails detected were COVID-19 related.

Adding further context to this percent increase, the nonprofit Anti Phishing Working Group recorded only 132,553 unique email phishing campaigns in all of Q4 2019 - and that was an increase from the previous two quarters!

It is widely accepted that email phishing serves as the primary attack vector for nearly 90% of all cyberattacks. There are a couple of reasons why, led by the ubiquity of email usage. In fact, in 2018, it was estimated that 24.5 billion business emails and 111.1 consumer emails are sent and received each day. The other primary reason that hackers prioritize email is because it was not built with security in mind - it was simply designed as a communications medium that turned out to be riddled with vulnerabilities.

Ever since email evolved into the predominant communications medium in the mid 2000’s, cybersecurity experts and hacking groups have played an endless game of cat and mouse in which every time an adversary improves or alters their phishing techniques, cyber pros counter with a new type of defense. It’s an endless cycle that has benefited both groups.

Amidst COVID-19, trust in email security slows

The increase in phishing attacks in the era of COVID-19 is unimaginable. As if the news cycle wasn’t already bad enough, seemingly every day stories about attacks targeting remote workers and spoofing attempts impersonating government and nonprofit organizations such as the CDC and WHO, are penetrating mainstream newsfeeds. There are even coronavirus themed phishing emails pretending to be from President Trump.

Such an onslaught of phishing emails over a short period of time has led many to start asking a simple question - Does email security actually work? A recent article headline in Threatpost, Top Email Protections Fail in Latest COVID-19 Phishing Campaign, suggests that the public may be starting to lose faith in our ability to control phishing.

The truth, however, is that current email phishing attacks remain successful for the same reasons they were effective before COVID-19 made it into our lexicon. Thus, the idea that COVID-19 has triggered email security to fail is a perception created by the unexpected onslaught of attacks and not because of some new and novel phishing techniques that anti-phishing technology doesn’t know how to solve.

The vulnerabilities and challenges of email security tools

Currently, it is the same limitations and vulnerabilities of the two most commonly deployed email security methods – secure email gateways (SEGs) and the Domain-based Authentication Reporting and Conformance (DMARC) protocol – that are enabling so many COVID-19 era malicious emails to make it into both business and consumer inboxes.

Over the past few years, SEGs have been increasingly under the microscope, as attackers continue to get smarter and more proficient at defeating gateway-level controls not built to identify file-less and link-less social engineering attacks. In fact, the continued prevalence of SEGs in both consumer email applications and as B2B email security technology is the main catalyst for the rise in business email compromise attacks, which according to the FBI is now the most costly attack vector for business.

But there are two other limitations of SEGs that prevent this technology from acting as the silver bullet it once was positioned to be. Those include its inability to:

  • Stop 99.5% of email spoofing attacks, including those that link to malicious phishing websites with visually similar login pages.
  • Identify polymorphism, which occurs when an attacker implements a slight but significant and often random changes to an email, such as its content, copy, subject line, sender name or template, in conjunction with or after an initial attack has deployed.

DMARC has also emerged as a popular email security solution to combat the rise of email spoofing attacks. The quagmire with DMARC is that while it is effective at what it was built for - stopping exact domain spoofing attacks - it is time consuming to implement and maintain, while also requires reciprocity to work (meaning the sender and receiver must both be compliant).

It is also important to note that exact domain spoofs, which occurs when an email is sent from a fraudulent domain that matches exactly to the spoofed brand’s domain, represents less than 1% of all email spoofing attempts due to the time and complexity needed to pull it off. With COVID-19, the vast majority of the spoofing emails are either exact sender name impersonations, similar sender name impersonations and look alike/cousin domain name spoofs, which DMARC cannot stop.

Reducing phishing risk in uncertain times

It’s safe to say that there will be many lessons learned post COVID-19. For one, hackers are going to hack and exploit world crises at any time to fulfill their motivation. As a result, the cybersecurity community must unite in the future and make its own pandemic response plan. Until then, consumers must scrutinize every email that looks suspicious and resist the urge to click on links and download attachments unless they are 100% sure of its validity.

Simultaneously, businesses must continue to train their employees in anti-phishing hyper vigilance. As remote work continues, now is the perfect time for security and HR teams to mandate phishing awareness training, or re-training, and to execute test phishing attacks using timely scenarios against employees. For those companies with more advanced email security, such as platforms built on AI and machine learning, risk will still continue to prevail, although it will likely be less than the risk faced by company’s reliant on SEGs and/or DMARC.

I hope people will find some confidence in knowing that email security is not failing. Both SEGs and DMARC are working as they should, although the reality is that both are plagued by the same challenges and limitations that have allowed email phishing attacks to land in mailboxes over time.

Hopefully, the influx of phishing emails will soon fade away along with the coronavirus. Until then, stay safe everyone - both offline and on.


  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity


New Products

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge. 3

  • XS4 Original+

    XS4 Original+

    The SALTO XS4 Original+ design is based on the same proven housing and mechanical mechanisms of the XS4 Original. The XS4 Original+, however, is embedded with SALTO’s BLUEnet real-time functionality and SVN-Flex capability that enables SALTO stand-alone smart XS4 Original+ locks to update user credentials directly at the door. Compatible with the array of SALTO platform solutions including SALTO Space data-on-card, SALTO KS Keys as a Service cloud-based access solution, and SALTO’s JustIn Mobile technology for digital keys. The XS4 Original+ also includes RFID Mifare DESFire, Bluetooth LE and NFC technology functionality. 3

  • ComNet CNGE6FX2TX4PoE

    The ComNet cost-efficient CNGE6FX2TX4PoE is a six-port switch that offers four Gbps TX ports that support the IEEE802.3at standard and provide up to 30 watts of PoE to PDs. It also has a dedicated FX/TX combination port as well as a single FX SFP to act as an additional port or an uplink port, giving the user additional options in managing network traffic. The CNGE6FX2TX4PoE is designed for use in unconditioned environments and typically used in perimeter surveillance. 3