Cybersecurity officials and meteorologists are warning of an increase in phishing attempts masquerading as severe weather alerts, with false claims of a “massive” cyclone forming near New Zealand circulating online.
One such post falsely claimed a large cyclone was forming in the Tasman Sea and heading towards New Zealand.
It featured dramatic storm imagery and an outdated map of ex-Cyclone Uesi, which impacted the west of the South Island in 2020.
In the comments section, a link directed users to an external website — a tactic commonly used to steal personal information or infect devices with malware.
It comes as numerous genuine weather alerts were in force nationwide yesterday, with heavy rain and gale-force winds expected as two active fronts approached.
Netsafe chief online safety officer Sean Lyons said the scam exploited a heightened state of awareness following a series of severe weather events in the past month, including a tornado in Levin, flooding thunderstorms in Auckland, and damage from Ex-Tropical Cyclone Tam.
April ended with a deep low-pressure system that triggered states of emergency in several regions and brought Wellington its strongest winds in over a decade.
“Using the weather shows how attuned they are to what’s going on here,” he said.
Lyons said scams like these may be about harvesting the credentials of users and compiling a list of people susceptible to stories about a certain topic.
“It’s like a pre-qualifying list, so then you can go on and focus the real scam on a highly qualified list of people that you’re pretty sure are going to feel the right kind of emotional tug. You’re doing that with a much less scattershot approach, not sending out a million and getting one or two back, but crafting a couple of hundred and getting ten back.”
He warned people to be “extra cautious” when interacting with links like this online.
“What seems to just be an innocuous click could actually be the start of somebody trying to target us for something an awful lot more frightening.”
The National Cyber Security Centre (NCSC) said the post was a form of phishing where scammers enticed readers to click a link by posting alarming fake news stories online.
“Attackers are always looking for new ways to reach their targets, and it’s not unusual for them to use times of crisis as opportunities to obtain funds and information from victims,” an NCSC spokesperson said.
They urged people to “pause and think before you click” and to treat unknown websites and requests for money or personal information cautiously.
“Seek alternative sources for information and apply a degree of scrutiny to sites that are less well-known.”
MetService, the country’s official provider of severe weather warnings, said there were no tropical cyclones present or forecast in the South Pacific.
“If there is a threat of severe weather such as a cyclone, we will issue severe weather warnings as appropriate,” a spokesperson said.
They also provided some tips, including to check for a reference to MetService as the official provider of severe weather information, if dates were correct on any images used, and a cross check of the information with a trusted source.
