World Health Organisation is it? Desi hackers target global agency

San Francisco

These “hack-for-hire” firms, many based in India, have been creating Gmail accounts spoofing the WHO, largely targeting business leaders in financial services, consulting, and healthcare corporations within numerous countries including, the US, Slovenia, Canada and India.

“The lures themselves encourage individuals to sign up for direct notifications from the WHO to stay informed of COVID-19 related announcements, and link to attacker-hosted websites that bear a strong resemblance to the official WHO website,” security researchers from Google’s Threat Analysis Group said.

The sites typically feature fake login pages that prompt potential victims to give up their Google account credentials, and occasionally encourage individuals to give up other personal information, such as their phone numbers.

On any given day, Google’s Threat Analysis Group said it is tracking more than 270 targeted or governmentbacked attacker groups from more than 50 countries.

Last month, it sent 1,755 warnings to users whose accounts were targets of governmentbacked attackers.

“Our team of analysts and security experts is focused on identifying and stopping issues like phishing campaigns, zero-day vulnerabilities and hacking against Google, our products and our users,” it said. Google continues to see attacks from groups like Charming Kitten on medical and healthcare professionals, including WHO employees.