Health authorities around the world are keeping a close eye on Monkeypox outbreaks that have been happening since mid-May.

Unfortunately, health authorities aren’t the only ones keeping an eye on the matter as cybercriminals use the viral outbreak as a lure for phishing campaigns.

“Monkeypox is high on the news agenda so it comes as no surprise that cyber criminals are exploiting it. Cybercriminals adjust their phishing campaigns to be as timely and relevant as possible, using traditional attack methods to exploit current events in an attempt to lure busy and distracted people to engage with links in emails, applications or texts,” explains head of threat intelligence at Mimecast, Tim Campbell.

Monkeypox phishing campaigns spotted by Mimecast involve sending emails to targets with the subject line “‘mandatory monkeypox safety awareness training” or a version of this.

The email is made to look like an internal email, but once the malicious link in the email is clicked, employees are prompted to key in their login details. These details can then be used to execute further attacks on the company.

Mimecast says that it’s important that employees are made aware of this phishing tactic. This is especially important given that 65 percent of respondents in the Mimecast State of Email Security 2022 survey were the target of a phishing scam.

“With cyberattacks, it is a question of when, not if one will occur. It is important for organisations to have adequate, cybersecurity measures in place as well as a well-rehearsed cyber resilience response plan. Cybersecurity awareness training for their staff needs to be frequent and engaging to ensure they avoid clicking on risky links. Employees must scrutinise suspicious emails and not click on links if in any doubt,” says Campbell.

Whether it’s an email about monkeypox, COVID-19 or any other major news headline, it’s important to stop and inspect the email before you start clicking links.

Check the email address the email was sent from, but most importantly, contact the person who sent the email directly. If you are still unsure, contact your IT or system administrator and ask them.

[Image – CC 0 Pixabay]