Pierluigi Paganini December 03, 2021

Threat actors have started to exploit the interest in the Omicron COVID-19 variant and are using it as a lure in phishing campaigns.

Crooks have already started exploiting the interest in the Omicron COVID-19 variant and are using it as a lure in phishing attacks.

People are interested in the spreading of the new variant, the efficiency of the vaccines and the measures that will adopt the states to prevent its spreading, and threat actors are attempting to take advantage of this situation.

An Omicron COVID-19 campaign was spotted by UK authorities and the National Health Service (NHS) is warning about the Omicron COVID-19-themed phishing attacks.

These phishing messages offer a free Omicron PCR test that will allegedly allow recipients to avoid restrictions. One of the samples shared by UK’s consumer protection organization ‘Which?’ and published by BleepingComputer were sent by the email ‘[email protected]’ in the attempt to make emails more credible.

Upon clicking on the link embedded into the message, recipients are redirected to a fake NHS website where to apply for a “COVID-19 Omicron PCR test.”

The recipients have to fill a form with their data (name, date of birth, home address, mobile phone number, and email address), some security questions (i.e. mother’s maiden name), and finalize the procedure by making a payment of £1.24 ($1.65).

Clearly, the scammers aim at stealing the payment details of the recipients while making the payment.

Authorities are urging the citizens to be aware of suspicious emails or text messages that may be asking for financial details (i.e. credit card data, banking data). The NHS never asks for financial details in legitimate email correspondence.

“The NHS will: NEVER ask for payment – the vaccine is free NEVER ask for your bank details.”

Users that will receive suspicious messages can report them at “[email protected]”.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Omicron COVID-19)

[adrotate banner=”5″]

[adrotate banner=”13″]