What happens when employees open a COVID-19 themed attachment or fake login page?

If the lure works, the outcome is usually credential theft or malware infection. Fake Microsoft pages can harvest usernames and passwords, while ZIP or Excel attachments may drop loaders, trojans, or remote access malware. Once executed, the payload can enable command shell access, keylogging, file manipulation, and follow-on compromise across the environment.

How the lure turns into credential theft or malware

COVID-19 themed lures work because they exploit urgency, fear, and curiosity. A fake login page usually captures credentials immediately, while a malicious attachment executes code or persuades the user to enable macros, which starts the infection chain. The first stage may look harmless, but it is often designed to hand the attacker a foothold that can be reused for later access.

Once that foothold exists, the compromise can shift from a single user event to broader intrusion. Stolen credentials can be used to sign in as the victim, and malware can establish persistence, spawn command shells, and prepare the system for additional payloads or lateral movement.

What attackers typically gain after the first click

The immediate objective is usually either account access or host execution. Credential theft gives the attacker a valid identity and often bypasses perimeter controls, while malware gives them local execution that can be used for discovery, file manipulation, keylogging, or remote access. In practice, those two outcomes are often linked, because malware can also harvest saved credentials and session tokens.

The real risk is that the initial lure is only the entry point. After login or execution, attackers commonly look for email, file shares, cloud applications, or management tools that let them expand their reach. That is why a phishing page or attachment should be treated as a starting condition for follow-on abuse, not as a one-off event.

Why COVID-19 lures remain effective against employees

Pandemic-themed messages worked because they blended current events with plausible business disruption, making them feel time-sensitive and legitimate. Employees were more likely to open documents, follow links, or rush through a login prompt when the message appeared to concern policy updates, health guidance, shipping notices, or internal notices tied to the crisis.

The attacker does not need a sophisticated exploit if the message can steer the user into a credential prompt or a macro-enabled file. That makes the success of the campaign depend less on technical novelty and more on social engineering quality, branding realism, and whether the organisation has conditioned users to verify where they are entering credentials.

Risk and Threat Considerations

These lures create a combined exposure of credential compromise and malware infection, which is especially dangerous because either path can be enough to trigger downstream compromise. A stolen password may enable account takeover, while a malicious attachment can give the attacker code execution and a platform for persistence or internal discovery.

Failure mechanism: The user trusts the lure, enters credentials on a spoofed page, or enables content in a malicious attachment, allowing the attacker to capture authentication material or run payloads on the endpoint.

Impact: The attacker can impersonate the user, access connected services, deploy remote access tools, steal data, manipulate files, and use the compromised host as a launch point for broader intrusion.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1566 — Phishing	Phishing lures drive the credential theft and malware execution described in the question.
	T1059 — Command and Scripting Interpreter	Malicious attachments often lead to shell or script execution after the first click.
	T1110 — Brute Force	Stolen credentials from fake login pages can be reused for account access attempts.
Recommendation — Map suspicious lures to T1566 and tune detections for email-delivered credential theft and payload delivery. Hunt for T1059 execution artifacts when users open suspicious attachments or enable macros. Correlate stolen credential activity with T1110-style access attempts and block anomalous sign-ins.
NIST SP 800-53 Rev 5	IA-5 — Authenticator Management	Fake login pages target authenticators and stolen credentials, making lifecycle control material.
	SI-3 — Malicious Code Protection	Malicious attachments and payloads create direct malware infection risk.
	AU-6 — Audit Review, Analysis, and Reporting	Credential theft and follow-on compromise require log review and anomalous sign-in detection.
Recommendation — Rotate and revoke exposed authenticators quickly after phishing or credential theft. Strengthen malicious code controls for email attachments, downloads, and macro-enabled files. Review authentication and endpoint logs for signs of phishing-driven compromise.

Practitioner Guidance

What to verify: Treat any login prompt reached from email, chat, or an unexpected file as untrusted until the domain, certificate, and login flow match the organisation’s normal authentication route. If the lure involved an attachment, confirm whether macros, embedded links, or archive contents were allowed to execute before assuming it was only a user-awareness event.

Decision rule: If the employee entered credentials, prioritise password reset, session revocation, and mailbox or SSO activity review. If the attachment executed, prioritise endpoint containment and malware triage first, because the attacker may already have local foothold and may have harvested additional secrets from the host.

Practitioner takeaway: The first click matters because it can convert a perception problem into either an identity compromise or an endpoint compromise, and both paths require fast containment before the attacker turns initial access into persistence.