In Brazil, scammers see the coronavirus as a serious money

IBM has uncovered nearly 700 malicious websites related to COVID-19 in Brazil in recent months.

Brazilian President Jair Bolsonaro’s critics say he hasn’t taken the impact of the coronavirus seriously. The same can’t be said for Brazil’s cybercriminals.

As deaths from the virus have surged past 66,000 in Brazil, scammers have set up new infrastructure to dupe people who are desperate for relief, and have set up bank accounts in their names. At a time when even more people in South America’s biggest country are glued to their phones or computers, Brazil’s already-flourishing cybercriminal economy has been busy.

“Scam operations have been highly effective in Brazil, from the first announcement of the government assistance program,” Jefferson Macedo, managing consultant on IBM’s X-Force security team, told CyberScoop.

IBM has uncovered nearly 700 malicious websites related to COVID-19, the disease caused by the virus, in recent months. The crooks are impersonating government apps used to sign up for financial relief and sending people a flurry of text and email messages asking them to hand over their data.

Bolsonaro, who was diagnosed with COVID-19 this week, has previously declined to wear a mask and dismissed the virus as akin to the flu. But Brazilian authorities are still distributing health equipment and economic aid in response to the virus, and crooks are exploiting people seeking that relief.

The data underscores Brazil’s longstanding struggles with cybercrime. In the last several years, the Brazilian financial sector has had to deal with multiple versions of malware designed to steal customers’ credentials. One of those hacking tools — known as the Boleto trojan — has reportedly caused hundreds of millions of dollars in losses.

“Cybercrime groups in Brazil are creative and highly motivated to find different ways to infiltrate people’s daily activities to make money,” said Macedo, who is based in São Paulo, Brazil’s largest city.

Embassy warns Americans in Brazil of scams

The IBM researchers found that scammers have used popular platforms like WhatsApp in Brazil to propagate malicious software. In some cases, Macedo said, the hackers are stealing contact lists from WhatsApp users and sending requests for money to recover from the virus. The crooks are even using promotional codes from TV shows and live music events to try to rip people off.

While Brazil is known to have a vibrant set of underground cybercriminal forums where hackers can swap techniques, those forums have been relatively quiet on the subject of COVID-19 scams, according to threat-intelligence firm Recorded Future.

Instead, many recent Brazilian scams have been out in the open, including the targeting of people’s personal data through phony Facebook pages and messages, according to researchers. In data prepared for CyberScoop, Recorded Future also found that Brazilian crooks were using the messaging platform Telegram to offer “coronavirus promotions,” or discounted rates for stolen credit card information.

Macedo said Brazilian authorities were trying to raise awareness about the scams, but more could be done. U.S. prosecutors are trying to help.

In March, there was a 124% increase in cyberattacks on mobile devices in Brazil, claimed Daniel Ackerman, a Department of Justice prosecutor based at the U.S. consulate in São Paulo. He advises Brazilian authorities on how to crack down on malicious hackers.

“Are you a U.S. citizen in Brazil?” Ackerman said in a YouTube video distributed by the U.S. embassy. “If so, do you realize that you could be a victim of cybercrime here just as easily as in the United States?”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure