COVID-19 phishing: How attackers exploited the pandemic in 2020

Within days of the World Health Organization declaring COVID-19 a pandemic, phishing campaigns adapted. Fake CDC alerts warned of outbreaks in the recipient's neighborhood. Fraudulent emails claimed to offer stimulus check information. Counterfeit sellers advertised masks, ventilators, and sanitizers that did not exist. Attackers moved fast because they knew employees were anxious, distracted, and receiving more email than ever. Here is what organizations faced and how they should have responded.

The main COVID-19 phishing themes

Security researchers tracked several dominant themes in early 2020. The most common were: fake health advisories impersonating the CDC, WHO, or local health departments; fraudulent government stimulus and relief communications; fake workplace policy updates about remote work or office closures; counterfeit medical supply offers and donation requests; and fake IT support messages claiming the employee's remote access needed updating. Each theme preyed on a specific fear or urgent need that the pandemic created.

Why the pandemic made phishing more effective

Phishing relies on emotion and urgency. COVID-19 provided both in abundance. Employees worried about their health, their families, their jobs, and their finances. They received legitimate emails from their employer, their bank, and government agencies at volumes they had never seen before. Distinguishing real from fake became harder. Attackers also knew that IT and security teams were overwhelmed with the sudden shift to remote work, making response slower and detection harder.

Red flags specific to pandemic phishing

The same general phishing indicators still applied, but some became especially important in 2020. Employees should have been trained to watch for: urgency tied to health or financial threats, which legitimate agencies rarely use; requests for personal information, passwords, or payment details via email; links that did not match the supposed sender's official domain; attachments claiming to be health maps, outbreak trackers, or safety guides; and any email claiming to be from the CDC or WHO that did not come from a cdc.gov or who.int address. These were not subtle attacks. They were effective because people were scared.

What organizations should have done

The most effective response combined technical controls and employee awareness. Organizations should have: reinforced email filtering and attachment scanning; sent a clear all-staff communication warning about COVID-19 phishing; reminded employees of the established reporting process for suspicious emails; updated security awareness training to include pandemic-specific examples; and ensured that remote workers had the same security tooling as office workers. Waiting until after an incident to address this was a common and costly mistake.

Training employees to stay skeptical

The core message for employees should have been simple: during a crisis, phishing increases. Verify unexpected requests through a separate channel, even if the email looks official. Do not click links or open attachments from unknown senders. Be especially cautious with health, financial, and IT-related emails. When in doubt, report it. Organizations that delivered this message clearly and quickly gave their employees the best protection available.