Scammers are impersonating the New York Department of Labor to steal personal information from state residents seeking money from a relief fund in the face of the COVID-19.
The scammers are sending unsuspecting victims an email with the state's logo that appears to come from noreply@labor.ny.gov. The email states that by activating their account, the recipient will receive $600 in aid for the health crisis.
Specifically, the email reads the following: “Dear Citizen, Due to COVID-19 related issues, NY.GOV will provide $600 to those affected by this pandemic. Complete the online form to participate in the assistance program. Click here to activate your account. Please do not close your browser while completing account activation. Thank you, State of New York.
A malicious link contained in the email directs unsuspecting victims to a website controlled by the scammers. The page is set up to "mimic" a page from the New York government website
Victims are asked to fill out a form that asks for their name, address, date of birth, social security number, and driver's license number.
The new phishing attack was discovered by researchers at Abnormal Security. The researchers determined that the real sender of the email was naij30@naija9icevibes.com, a domain associated with Panama and has no connection to the New York government.
Researchers noted that the email contains a link that supposedly leads to a NY.GOV website . However, it actually points to https://thesender[.]org/fjc4 . When someone clicks on this link, they will be redirected to bo2.cloudns.cl/NYU/cnf[.]php , a phishing page that appears to be a legitimate government website. Although this page displays the official logo of the New York state government, the URL is not associated with the New York Department of Labor.
The researchers also noted that Americans have already received some financial support during the pandemic from the government, so a recipient of this email is likely to be fooled into believing that the government is offering additional relief as the pandemic continues.
