The COVID‐19 scamdemic: A survey of phishing attacks and their countermeasures during COVID‐19

Abstract

The COVID-19 pandemic coincided with an equally-threatening scamdemic: a global epidemic of scams and frauds. The unprecedented cybersecurity concerns emerged during the pandemic sparked a torrent of research to investigate cyber-attacks and to propose solutions and countermeasures. Within the scamdemic, phishing was by far the most frequent type of attack. This survey paper reviews, summarises, compares and critically discusses 54 scientific studies and many reports by governmental bodies, security firms and the grey literature that investigated phishing attacks during COVID-19, or that proposed countermeasures against them. Our analysis identifies the main characteristics of the attacks and the main scientific trends for defending against them, thus highlighting current scientific challenges and promising avenues for future research and experimentation.

The development of phishing during the COVID-19 pandemic: An analysis of over 1100 targeted domains

“…Another group of studies focuses on identifying and aggregating the modus operandi used in phishing emails during the Covid-19 pandemic. A survey of Al-Qahtani and Cresci (2022) reviewed 54 studies about phishing attacks and analysed the modus operandi and the proposed techniques for detecting Covid-19 phishing, smishing and vishing attacks. As indicated in the Microsoft Digital Defense Report, phishing attacks consist of almost 70% of all cyber attacks ( Kaliňák, 2021 ).…”

An enhanced deep learning‐based phishing detection mechanism to effectively identify malicious URLs using variational autoencoders

“…Phishing was by far the most prevalent form of attack that had distinctive features and was intended to take advantage of COVID-19's quirks in order to maximise its likelihood of success. [5] The majority of prominent phishing attacks that took place during COVID 2019 focussed on posing as government agencies (such as the WHO or the US Centres for disease Control and Prevention (CDC)) by either creating a fake email/website to lure the users to enter their sensitive information.…”

Defending against social engineering attacks: A security pattern‐based analysis framework

“…Many researchers have studied phishing attacks and put forward corresponding countermeasures. Among all the recently proposed solutions to prevent phishing attacks, most research efforts have focussed on detecting phishing websites [22]. For example, Manoj et al.…”

“…Many researchers have studied phishing attacks and put forward corresponding countermeasures. Among all the recently proposed solutions to prevent phishing attacks, most research efforts have focussed on detecting phishing websites [22]. For example, Manoj et al [23] proposed an enhanced deep learning-based phishing detection approach by integrating the strength of Variational Autoencoders and deep neural networks to identify malicious URLs effectively.…”