In the time frame analyzed, Barracuda observed spikes in vaccine-related phishing activity centered around new updates, announcements and ground-breaking approvals from around the world. Researchers concluded that this is due to mass phishing campaigns centered around spiking public interest towards the vaccine, in an effort from the perpetrators to improve the effectiveness of their phishing attack campaigns.

Barracuda researchers identified two predominant types of spear-phishing attacks using vaccine-related themes: brand impersonation and business email compromise.

The former is an email attack form which is used to impersonate a well known brand or organization and includes a link to a phishing website advertising early access to vaccines, offering vaccinations in exchange for a payment, or even impersonating health care professionals requesting personal information to check eligibility for a vaccine.

Business Email Compromise (BEC) attacks are instead used to impersonate individuals within an organization or their business partners. Barracuda observed that recently these highly targeted attacks turned to vaccine-related topics. Common examples include impersonating employees needing an urgent favor while they are getting a vaccine or an HR specialist advising that the organization has secured vaccines for their employees. 

As vaccine rollout continues to pick up pace in a handful of countries around the world, continued increases in fraud surrounding this area is expected to continue.