COVID-19 Phishing Attacks are Exposing Email Security’s Biggest Flaws

To those of us who work in cybersecurity, hackers and nation state adversaries exploiting the pandemic to drive fear and misunderstanding is certainly horrific, but not at all unexpected. To put the situation into perspective, Tech Republic reported on a 667% increase in malicious email attacks in just a 22-day span (March 1-23). According to the article, more than 2% of those 467,000 spear-phishing emails detected were COVID-19 related.

Adding further context to this percent increase, the nonprofit Anti Phishing Working Group recorded only 132,553 unique email phishing campaigns in all of Q4 2019 - and that was an increase from the previous two quarters!

It is widely accepted that email phishing serves as the primary attack vector for nearly 90% of all cyberattacks. There are a couple of reasons why, led by the ubiquity of email usage. In fact, in 2018, it was estimated that 24.5 billion business emails and 111.1 consumer emails are sent and received each day. The other primary reason that hackers prioritize email is because it was not built with security in mind - it was simply designed as a communications medium that turned out to be riddled with vulnerabilities.

Ever since email evolved into the predominant communications medium in the mid 2000’s, cybersecurity experts and hacking groups have played an endless game of cat and mouse in which every time an adversary improves or alters their phishing techniques, cyber pros counter with a new type of defense. It’s an endless cycle that has benefited both groups.

Amidst COVID-19, trust in email security slows

The increase in phishing attacks in the era of COVID-19 is unimaginable. As if the news cycle wasn’t already bad enough, seemingly every day stories about attacks targeting remote workers and spoofing attempts impersonating government and nonprofit organizations such as the CDC and WHO, are penetrating mainstream newsfeeds. There are even coronavirus themed phishing emails pretending to be from President Trump.

Such an onslaught of phishing emails over a short period of time has led many to start asking a simple question - Does email security actually work? A recent article headline in Threatpost, Top Email Protections Fail in Latest COVID-19 Phishing Campaign, suggests that the public may be starting to lose faith in our ability to control phishing.

The truth, however, is that current email phishing attacks remain successful for the same reasons they were effective before COVID-19 made it into our lexicon. Thus, the idea that COVID-19 has triggered email security to fail is a perception created by the unexpected onslaught of attacks and not because of some new and novel phishing techniques that anti-phishing technology doesn’t know how to solve.

The vulnerabilities and challenges of email security tools

Currently, it is the same limitations and vulnerabilities of the two most commonly deployed email security methods – secure email gateways (SEGs) and the Domain-based Authentication Reporting and Conformance (DMARC) protocol – that are enabling so many COVID-19 era malicious emails to make it into both business and consumer inboxes.

Over the past few years, SEGs have been increasingly under the microscope, as attackers continue to get smarter and more proficient at defeating gateway-level controls not built to identify file-less and link-less social engineering attacks. In fact, the continued prevalence of SEGs in both consumer email applications and as B2B email security technology is the main catalyst for the rise in business email compromise attacks, which according to the FBI is now the most costly attack vector for business.

But there are two other limitations of SEGs that prevent this technology from acting as the silver bullet it once was positioned to be. Those include its inability to:

  • Stop 99.5% of email spoofing attacks, including those that link to malicious phishing websites with visually similar login pages.
  • Identify polymorphism, which occurs when an attacker implements a slight but significant and often random changes to an email, such as its content, copy, subject line, sender name or template, in conjunction with or after an initial attack has deployed.

DMARC has also emerged as a popular email security solution to combat the rise of email spoofing attacks. The quagmire with DMARC is that while it is effective at what it was built for - stopping exact domain spoofing attacks - it is time consuming to implement and maintain, while also requires reciprocity to work (meaning the sender and receiver must both be compliant).

It is also important to note that exact domain spoofs, which occurs when an email is sent from a fraudulent domain that matches exactly to the spoofed brand’s domain, represents less than 1% of all email spoofing attempts due to the time and complexity needed to pull it off. With COVID-19, the vast majority of the spoofing emails are either exact sender name impersonations, similar sender name impersonations and look alike/cousin domain name spoofs, which DMARC cannot stop.

Reducing phishing risk in uncertain times

It’s safe to say that there will be many lessons learned post COVID-19. For one, hackers are going to hack and exploit world crises at any time to fulfill their motivation. As a result, the cybersecurity community must unite in the future and make its own pandemic response plan. Until then, consumers must scrutinize every email that looks suspicious and resist the urge to click on links and download attachments unless they are 100% sure of its validity.

Simultaneously, businesses must continue to train their employees in anti-phishing hyper vigilance. As remote work continues, now is the perfect time for security and HR teams to mandate phishing awareness training, or re-training, and to execute test phishing attacks using timely scenarios against employees. For those companies with more advanced email security, such as platforms built on AI and machine learning, risk will still continue to prevail, although it will likely be less than the risk faced by company’s reliant on SEGs and/or DMARC.

I hope people will find some confidence in knowing that email security is not failing. Both SEGs and DMARC are working as they should, although the reality is that both are plagued by the same challenges and limitations that have allowed email phishing attacks to land in mailboxes over time.

Hopefully, the influx of phishing emails will soon fade away along with the coronavirus. Until then, stay safe everyone - both offline and on.


  • Report: Physical Security Market Turning to Cloud and Hybrid Solutions

    Genetec, a provider of unified security, public safety, operations, and business intelligence solutions, today shared the results of its 2024 State of Physical Security report. Based on insights from over 5,500 physical security leaders worldwide (including end users and channel partners), the report looks at the security strategies organizations are putting in place to effectively navigate the realities of a changing industry. Read Now

  • A Future in the Clouds

    The cloud has become a pervasive term in everyone’s daily work and personal lives – from the explosion of content available on Internet streaming services to remote learning to social interactions. Everyone is living cloud-based lives. Read Now

  • A Rapidly Changing Realm

    Many retail operators continue to face a daily balancing act of maintaining both an online and in-person presence. The coronavirus pandemic accelerated our adoption of online shopping, and the expectation now is that every retailer needs to be proficient in both arenas. This places a heightened emphasis on secure operations that ensure a seamless experience for the customer no matter where they pull out their credit card. Read Now

  • Secure Your Home During the Holidays

    The most wonderful time of the year can easily transform into a nightmare. Being vigilant, while still enjoying the holiday season, is possible. The holiday season is the perfect time to start implementing security measures to protect one’s home and ensure security while out and about. Read Now

Featured Cybersecurity

New Products

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions. 3

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3