The amount of news coverage and impact surrounding the coronavirus pandemic has continued to create an opportunity for cyber-criminals to take advantage of individuals in the form of phishing attacks, email scams and zoom video hijacking.

Looking to exploit the public’s fears and to take advantage of the increase in teleworking during the pandemic, cyber-criminals are sending email messages claiming to be from legitimate organizations with information about  COVID-19 and the Care Act.  Additionally, Zoom phishing emails and Zoom-bombing of video conferences have increased significantly over the last month.

We ask that all Capital University employees and students continue to maintain high awareness and to be very vigilance in not falling prey to these attacks.  Please review and educate yourself with the latest information below and report and/or forward any suspicious activity, spam, emails or phishing attacks to abuse@capital.edu. 

Covid-19 Phishing Awareness

Phishing messages will utilize tactics with a COVID-19 spin to them. Here are some things to be on the lookout for:

1. An email asking you to open an attachment claiming to “provide the latest statistics on the virus”
2. Encouraging you to click a link that will provide helpful information on “staying clear of the virus”
3. Asking you to provide personal information to “see if your area is being affected by the virus”
4. An email asking for information to receive government stimulus checks

Zoom Bombing Awareness

Across higher education, there is an increase in Zoom related phishing emails and Zoom-bombing incidents. Zoom-bombing is where Zoom video conferences used for online lessons and business meetings are hijacked and disrupted.

Zoom phishing emails may come in the form of a Zoom meeting request from an official-looking, branded, and registered Zoom domain.  They may include links such as zoom-us-zoom_##########.exe which likely contains malware.

Some best practices to apply when using Zoom include:

1. When utilizing Zoom for official Capital University business and classes, utilize the capital.zoom.us domain
2. Utilize private meeting rooms
3. Do not share Zoom conference links on public social media
4. Manage screen-sharing options (such as screen sharing to “Host Only”)
5. Create a “waiting room” within your Zoom conference meeting so that all persons must be verified and admitted by you only
6. When accepting a Zoom meeting request, verify it is from a known person and Zoom domain

Student Aid & The CARES Act Scam

The Coronavirus Aid, Relief, and Economic Security (CARES) Act includes funds intended to provide emergency assistance to university students. Many of our students will be eligible and will be receiving CARES Act grants.

Scammers are also aware of these grants and are already plotting ways to exploit the situation. Be vigilant for phishing scams related to the CARES Act student assistance that are likely to surface in the coming days and weeks.

Keep in mind the following tips for spotting scams:

1. Federal, state, and local governments will not ask you to pay a “deposit” or any other fees to obtain CARES Act grants. Any attempt to collect money in exchange for grants is a scam
2. Neither the government nor the University will request your Social Security number, bank account number or credit card number as a prerequisite for receiving a CARES Act grant
3. Refer to Capital University’s official web page (https://www.capital.edu/cares-application/) for details about student aid being distributed through the CARES Act

What can you do?

1. Be careful opening any web links or attachments, even if you know the sender, it may be a compromised sender.
2. If you suspect that you have received a phishing email, delete it and do not open or click on any links.
3. Look for “Red Flags” in emails you receive. Red Flags include abnormalities in the sender, topic, links, content, etc.
4. Additional tips for spotting phishing scams is available on the following IT web page: https://members.eiia.org/wp-content/uploads/assets/SocialEngineeringRedFlags.pdf
5. Please remember that emails with the words COVID-19 or Coronavirus coming from outside the University will be flagged with a header below: 
6. Contact your IT department whenever you have any doubts or concerns at helpdesk@capital.edu or 614-236-6508.