Many phishing campaigns have been detected to impersonate the World Health Organization (WHO). This time hackers are trying to take advantage of public concern over the coronavirus that is increasing each day worldwide. As reported, there are a few types of phishing emails that misuse the pandemic COVID-19 situation. However, the purpose of all these emails is to deliver malware on computer operating systems and make people victims of phishing schemes.
Our team identified that among the malicious programs propagated via “World Health Organization (WHO)” email scams are the reported HawkEye Trojan , GuLoader, Agent Tesla and Formbook. However, these may not be all malware proliferated by WHO phishing emails.
Threat Summary
| Name | “World Health Organization (WHO)” E-mail Scam |
| Type | E-Mail Scams |
| Short Description | Aim to trick people into transferring BitCoins to hackers, installing malware, and providing sensitive credentials. |
| Symptoms | Messages pretend to be sent by the World Health Organization (WHO). |
| Distribution Method | Via massive spam campaigns. |
| Detection Tool |
See If Your System Has Been Affected by malware
Download
Malware Removal Tool
|
User Experience | Join Our Forum to Discuss malware delivered by "World Health Organization (WHO)" e-mail scam. |
So, if you receive an email sent by a supposedly World Health Organization representative, first verify the authenticity of this email and then decide whether to reply and follow the presented instructions or just move that email to the Trash.
Note that the World Health Organization (WHO) does not send emails from addresses ending in “@who.com”, “@who.org” or “@who-safety.org”. The only legitimate format used by the organization is @who.int If you notice any other symbol after the “@” symbol then consider the sender as a fraudster.
Types of “World Health Organization (WHO)” Email Scams
Currently, the main variants of the World Health Organization (WHO) email scam are four. Since the crisis situation is likely to grow further, the variants of these nasty phishing scams may increase as well.
Before we review the main four types of World Health Organization (WHO) email phishing campaigns, let’s summarize the purposes of their spread:
- 1. Money theft under the pretext that the organization needs donations to effectively battle the coronavirus crisis
2. Information gathering
3. Propagation of downloaders and info stealing Trojans like Agent Tesla, HawkEye, GuLoader, and Formbook.
”COVID-19 Solidarity Response Fund for WHO – DONATE NOW” Email Scam
This letter explains the purpose of the World Health Organization (WHO) and reveals the measures the organization is taking to battle the disastrous Coronavirus. Here is a copy of its text message:
World Health Organization
We are all affected by the growing COVID-19 pandemic.
It’s an unprecedented health challenge and we know people and organizations everywhere want to help.
The World Health Organization is leading and coordinating the global effort,
supporting countries to prevent, detect, and respond to the pandemic.The greatest need right now is to help ensure all countries are prepared,
especially those with the weakest health systems.
Donations support WHOs work to track and understand the spread of the virus;
to ensure patients get the care they need and frontline workers get essential supplies and information;
and to accelerate efforts to develop vaccines, tests, and treatments.See below for information on other ways to give, tax-deductibility and corporate and foundation giving options.
Now you can help us by donating any amount what you want help with the
BITCOIN NETWORKDonate Now with Bitcoin payment.
World Health Organization bitcoin address(BTC Wallet) for
donations:
16gmYrbqMr4SZeA7SqNVmirhnhDG3maYPK
Online donations made via bitcoin are tax deductible in the U.S. and Europe.
To the extent allowable by law.The World Health Organization accepts checks or wire transfers from
anywhere in the world.
World Health Organization doesn’t may to provide tax benefits to donors
to these payments.Contact to email if you have any questions.
The primary goal of this email is to convince you to donate funds to support the WHO efforts against the Coronavirus. All donations are required in Bitcoin cryptocurrency. In reality, the presented details are related to cybercriminals’ crypto-wallets.
”Coronavirus disease (COVID-19) outbreak prevention and cure update“ Email Subject Line
This variant of the WHO email scam contains an attachment which as stated contains a list of easy to follow instructions and common medication that can be taken as a precaution against the Coronavirus. Here is what it states:
Dear ********
Please find the attached file with the instructions on comon drugs to take for prevention and fase cure to this deadly virus called
Coronavirus Disease (COVID-19).This is an instruction from WHO (World Health Organization) to help fight agaisnt coronavirus.
NOTE : once received this mail review the attached file and follow the instructions .
please forward to your family members and friends to help us reach every one on how to fight
this virus , and the instructions are very simple and affordable.Thanks
Best regard
Director WHO (World Health Organization)
Dr. Tedros Adhanom W.H.OVeriforce and PEC Safety have merge. Learn more.
This e-mail is confidential and is intended solely for the use of the recipient. If you are not the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited.
Beware as the attached file, in fact, contains malicious software – a Trojan – that is called Agent Tesla RAT (Remote Access Trojan). The moment this Trojan accesses a target operating system, it can perform lots of malicious operations that will eventually enable it to steal sensitive credentials and let hackers enter remotely your device.
”W.H.O.”CORONAVIRUS(COV,19) SAFETY&PREVENTIVE MEASURES” Phishing Email
In this case, cybercriminals attempt to trick users into downloading and opening a malicious attachment on their PCs by claiming that the file contains healthy recommendations for everyday prevention steps against the virus. See its full message:
With regards to the ‘Medical Outbreak’ in the World due to Coronavirus (CoV) threatening to run riot all over the world; we know, this is a stressful time and we all want to know what we can do right now to protect ourselves and our families to prevent from getting exposed to this disease.
We at W.H.O(WORLD HEALTH ORGANIZATION), really care about the health & safety of all the people in the world, that is why we have highlighted/recommended in the attachment some everyday health and preparedness steps that the whole world can follow and be safe:
WHO Headquarters
Hands and stones
The World Bank/Alejandro LipszycFor more information regarding Healthy Settings, please contact:
Interventions for Healthy Environments Unit (IHE)
Public Health and Environment Department (PHE)
World Health Organization
20 Avenue Appia
1211 Geneva 27
Switzerland
Fax No.: +41 22 791 13 83 Attention: Healthy Settings
E-mail: phedoc@who.int
”Latest on corona-virus” Scam Email
This email features an archived file attachment called My-health. As suggested in the email this file is an e-book that will help you learn important information about COVID-19 – its origin, different researches of the virus, transmission scenarios, protection and prevention tips and probably the most tempting one – adaptation instructions and emergency plans for national and local authorities. See a copy of the message of this email:
Corona-virus updates
Concerning Corona-virus disease (COVID-19) outbreak, the World Health Organization brings you the Corona-virus E-Book and Guide.Inside this E-Book (My-health), you shall find out the complete research/origin of corona-virus and the recommended guide to follow to protect yourself and others.
Guidance to protect children and business centre;
This guidance provides critical considerations and practical checklists to keep Kids and business centre safe. It also advises national and local authorities on how to adapt and implement emergency plans for educational facilities.
Critical preparedness, readiness and response actions for COVID-19;
WHO has defined four transmission scenarios for COVID-19. My Health E-book describes the preparedness, readiness and response for each transmission scenario.
Basic protective measures against the new corona-virus;
1. Stay aware with the most contented information on the COVID-19 outbreak, available on the E-Book attached to this mail and through your national and local public health authority.
2. Avoid touching Eyes, Nose and mouth
Why? Hands touch many surfaces and can pick up viruses. Once contaminated, hands can transfer the virus to your eyes, nose or mouth.3. Practice respiratory hygiene
This will also protect you and help prevent the spread of viruses and other infections.You can now download and access the attached My Health Zip file from a Windows Computer only.
You are receiving this email because your life count as everyone lives count. Sign up for more updates at the WHO website (www.who[.]int).
Thanks for helping to make the world a little healthier.
Instead of providing a useful book on how to be more aware of the Coronavirus and how to deal with it, the email delivers the nasty GuLoader malware that is a typical downloader. Once started on your machine, this malware enables hackers to download and install additional malicious programs like info stealers, ransomware, spyware, and so on.
How to Defend Yourself Against WHO Related Phishing Attempts
Here are the most important things to have in mind when and if you receive an email that is allegedly sent by the World Health Organization:
- 1. Ensure that the email sender is a real representative of the WHO. Look at the email address where you should find an email address that has the name@who.int pattern. All other combinations after the “@” symbol are evidence of a scam.
2. Do you see any links? Well, if yes, check them before you click them. All links that are related to the official WHO website start with https://www.who.int
3. Do not provide personal information and sensitive credentials to third-parties, not even to the WHO.
4. Try to not feel under pressure and don’t rush. Always take time to review the email details and consider whether you should act requested or not. Otherwise, you can easily provide your personal information to cybercriminals and online fraudsters.
5. Mistakes happen. If you fell victim to any of the WHO email scams or another online scam and gave sensitive information to fraudsters, don’t panic. What you should do is to immediately change your credentials on each site where you have used them. In the event that you provided some banking credentials make sure to call your bank and ask for appropriate assistance.
6. Report a scam, if you see it. The WHO is aware of the rising level of online threats that misuse their reputable name during this unfortunate for all of us, situation. They have opened a section on their official website where users can report various scams – here you can assess it – https://www.who.int/about/report_scam/en/
Remove Malware Delivered by “World Health Organization (WHO)” E-mail Scam from Your Computer
To remove any viruses related to “World Health Organization (WHO)” e-mail scam, then we suggest that you follow the steps below. They are suitable only if you know how to find it. For any other case, we strongly recommend automatic removal of malicious programs delivered by nasty e-mail scams. By using an advanced malware removal software you can delete automatically any malicious files and objects from your machine. This program has been created with the main idea to help you detect and get rid of any malicious files. Such a tool can protect your PC or Mac against future infections coming from scam mails as well.
Gergana Ivanova
Highly motivated writer with 5+ years of experience writing for ransomware, malware, adware, PUPs, and other cybersecurity-related issues. As a writer, I strive to create content that is based on thorough technical research. I find joy in the process of creating articles that are easy to understand, informative, and useful. Follow me on Twitter (@IRGergana) for the latest in the field of computer, mobile, and online security.
Follow Me:
- Windows
- Mac OS X
- Google Chrome
- Mozilla Firefox
- Microsoft Edge
- Safari
- Internet Explorer
- Stop Push Pop-ups
How to Remove malware delivered by "World Health Organization (WHO)" e-mail scam from Windows.
Step 1: Scan for malware delivered by "World Health Organization (WHO)" e-mail scam with SpyHunter Anti-Malware Tool
Step 2: Boot Your PC In Safe Mode
Step 3: Uninstall malware delivered by "World Health Organization (WHO)" e-mail scam and related software from Windows
Uninstall Steps for Windows 11
Uninstall Steps for Windows 10 and Older Versions
Here is a method in few easy steps that should be able to uninstall most programs. No matter if you are using Windows 10, 8, 7, Vista or XP, those steps will get the job done. Dragging the program or its folder to the recycle bin can be a very bad decision. If you do that, bits and pieces of the program are left behind, and that can lead to unstable work of your PC, errors with the file type associations and other unpleasant activities. The proper way to get a program off your computer is to Uninstall it. To do that:
Follow the instructions above and you will successfully uninstall most programs.
Step 4: Clean Any registries, Created by malware delivered by "World Health Organization (WHO)" e-mail scam on Your PC.
The usually targeted registries of Windows machines are the following:
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
You can access them by opening the Windows registry editor and deleting any values, created by malware delivered by "World Health Organization (WHO)" e-mail scam there. This can happen by following the steps underneath:
Tip: To find a virus-created value, you can right-click on it and click "Modify" to see which file it is set to run. If this is the virus file location, remove the value.
Video Removal Guide for malware delivered by "World Health Organization (WHO)" e-mail scam (Windows).
Get rid of malware delivered by "World Health Organization (WHO)" e-mail scam from Mac OS X.
Step 1: Uninstall malware delivered by "World Health Organization (WHO)" e-mail scam and remove related files and objects
Your Mac will then show you a list of items that start automatically when you log in. Look for any suspicious apps identical or similar to malware delivered by "World Health Organization (WHO)" e-mail scam. Check the app you want to stop from running automatically and then select on the Minus (“-“) icon to hide it.
- Go to Finder.
- In the search bar type the name of the app that you want to remove.
- Above the search bar change the two drop down menus to “System Files” and “Are Included” so that you can see all of the files associated with the application you want to remove. Bear in mind that some of the files may not be related to the app so be very careful which files you delete.
- If all of the files are related, hold the ⌘+A buttons to select them and then drive them to “Trash”.
In case you cannot remove malware delivered by "World Health Organization (WHO)" e-mail scam via Step 1 above:
In case you cannot find the virus files and objects in your Applications or other places we have shown above, you can manually look for them in the Libraries of your Mac. But before doing this, please read the disclaimer below:
You can repeat the same procedure with the following other Library directories:
→ ~/Library/LaunchAgents
/Library/LaunchDaemons
Tip: ~ is there on purpose, because it leads to more LaunchAgents.
Step 2: Scan for and remove malware delivered by "World Health Organization (WHO)" e-mail scam files from your Mac
When you are facing problems on your Mac as a result of unwanted scripts and programs such as malware delivered by "World Health Organization (WHO)" e-mail scam, the recommended way of eliminating the threat is by using an anti-malware program. SpyHunter for Mac offers advanced security features along with other modules that will improve your Mac’s security and protect it in the future.
Video Removal Guide for malware delivered by "World Health Organization (WHO)" e-mail scam (Mac)
Remove malware delivered by "World Health Organization (WHO)" e-mail scam from Google Chrome.
Step 1: Start Google Chrome and open the drop menu
Step 2: Move the cursor over "Tools" and then from the extended menu choose "Extensions"
Step 3: From the opened "Extensions" menu locate the unwanted extension and click on its "Remove" button.
Step 4: After the extension is removed, restart Google Chrome by closing it from the red "X" button at the top right corner and start it again.
Erase malware delivered by "World Health Organization (WHO)" e-mail scam from Mozilla Firefox.
Step 1: Start Mozilla Firefox. Open the menu window:
Step 2: Select the "Add-ons" icon from the menu.
Step 3: Select the unwanted extension and click "Remove"
Step 4: After the extension is removed, restart Mozilla Firefox by closing it from the red "X" button at the top right corner and start it again.
Uninstall malware delivered by "World Health Organization (WHO)" e-mail scam from Microsoft Edge.
Step 1: Start Edge browser.
Step 2: Open the drop menu by clicking on the icon at the top right corner.
Step 3: From the drop menu select "Extensions".
Step 4: Choose the suspected malicious extension you want to remove and then click on the gear icon.
Step 5: Remove the malicious extension by scrolling down and then clicking on Uninstall.
Remove malware delivered by "World Health Organization (WHO)" e-mail scam from Safari
Step 1: Start the Safari app.
Step 2: After hovering your mouse cursor to the top of the screen, click on the Safari text to open its drop down menu.
Step 3: From the menu, click on "Preferences".
Step 4: After that, select the 'Extensions' Tab.
Step 5: Click once on the extension you want to remove.
Step 6: Click 'Uninstall'.
A pop-up window will appear asking for confirmation to uninstall the extension. Select 'Uninstall' again, and the malware delivered by "World Health Organization (WHO)" e-mail scam will be removed.
Eliminate malware delivered by "World Health Organization (WHO)" e-mail scam from Internet Explorer.
Step 1: Start Internet Explorer.
Step 2: Click on the gear icon labeled 'Tools' to open the drop menu and select 'Manage Add-ons'
Step 3: In the 'Manage Add-ons' window.
Step 4: Select the extension you want to remove and then click 'Disable'. A pop-up window will appear to inform you that you are about to disable the selected extension, and some more add-ons might be disabled as well. Leave all the boxes checked, and click 'Disable'.
Step 5: After the unwanted extension has been removed, restart Internet Explorer by closing it from the red 'X' button located at the top right corner and start it again.
Remove Push Notifications from Your Browsers
Turn Off Push Notifications from Google Chrome
To disable any Push Notices from Google Chrome browser, please follow the steps below:
Step 1: Go to Settings in Chrome.
Step 2: In Settings, select “Advanced Settings”:
Step 3: Click “Content Settings”:
Step 4: Open “Notifications”:
Step 5: Click the three dots and choose Block, Edit or Remove options:
Remove Push Notifications on Firefox
Step 1: Go to Firefox Options.
Step 2: Go to “Settings”, type “notifications” in the search bar and click "Settings":
Step 3: Click “Remove” on any site you wish notifications gone and click “Save Changes”
Stop Push Notifications on Opera
Step 1: In Opera, press ALT+P to go to Settings.
Step 2: In Setting search, type “Content” to go to Content Settings.
Step 3: Open Notifications:
Step 4: Do the same as you did with Google Chrome (explained below):
Eliminate Push Notifications on Safari
Step 1: Open Safari Preferences.
Step 2: Choose the domain from where you like push pop-ups gone and change to "Deny" from "Allow".
malware delivered by "World Health Organization (WHO)" e-mail scam-FAQ
What Is malware delivered by "World Health Organization (WHO)" e-mail scam?
The malware delivered by "World Health Organization (WHO)" e-mail scam threat is adware or browser redirect virus.
It may slow your computer down significantly and display advertisements. The main idea is for your information to likely get stolen or more ads to appear on your device.
The creators of such unwanted apps work with pay-per-click schemes to get your computer to visit risky or different types of websites that may generate them funds. This is why they do not even care what types of websites show up on the ads. This makes their unwanted software indirectly risky for your OS.
What Are the Symptoms of malware delivered by "World Health Organization (WHO)" e-mail scam?
There are several symptoms to look for when this particular threat and also unwanted apps in general are active:
Symptom #1: Your computer may become slow and have poor performance in general.
Symptom #2: You have toolbars, add-ons or extensions on your web browsers that you don't remember adding.
Symptom #3: You see all types of ads, like ad-supported search results, pop-ups and redirects to randomly appear.
Symptom #4: You see installed apps on your Mac running automatically and you do not remember installing them.
Symptom #5: You see suspicious processes running in your Task Manager.
If you see one or more of those symptoms, then security experts recommend that you check your computer for viruses.
What Types of Unwanted Programs Are There?
According to most malware researchers and cyber-security experts, the threats that can currently affect your device can be rogue antivirus software, adware, browser hijackers, clickers, fake optimizers and any forms of PUPs.
What to Do If I Have a "virus" like malware delivered by "World Health Organization (WHO)" e-mail scam?
With few simple actions. First and foremost, it is imperative that you follow these steps:
Step 1: Find a safe computer and connect it to another network, not the one that your Mac was infected in.
Step 2: Change all of your passwords, starting from your email passwords.
Step 3: Enable two-factor authentication for protection of your important accounts.
Step 4: Call your bank to change your credit card details (secret code, etc.) if you have saved your credit card for online shopping or have done online activities with your card.
Step 5: Make sure to call your ISP (Internet provider or carrier) and ask them to change your IP address.
Step 6: Change your Wi-Fi password.
Step 7: (Optional): Make sure to scan all of the devices connected to your network for viruses and repeat these steps for them if they are affected.
Step 8: Install anti-malware software with real-time protection on every device you have.
Step 9: Try not to download software from sites you know nothing about and stay away from low-reputation websites in general.
If you follow these recommendations, your network and all devices will become significantly more secure against any threats or information invasive software and be virus free and protected in the future too.
How Does malware delivered by "World Health Organization (WHO)" e-mail scam Work?
Once installed, malware delivered by "World Health Organization (WHO)" e-mail scam can collect data using trackers. This data is about your web browsing habits, such as the websites you visit and the search terms you use. It is then used to target you with ads or to sell your information to third parties.
malware delivered by "World Health Organization (WHO)" e-mail scam can also download other malicious software onto your computer, such as viruses and spyware, which can be used to steal your personal information and show risky ads, that may redirect to virus sites or scams.
Is malware delivered by "World Health Organization (WHO)" e-mail scam Malware?
The truth is that PUPs (adware, browser hijackers) are not viruses, but may be just as dangerous since they may show you and redirect you to malware websites and scam pages.
Many security experts classify potentially unwanted programs as malware. This is because of the unwanted effects that PUPs can cause, such as displaying intrusive ads and collecting user data without the user’s knowledge or consent.
About the malware delivered by "World Health Organization (WHO)" e-mail scam Research
The content we publish on SensorsTechForum.com, this malware delivered by "World Health Organization (WHO)" e-mail scam how-to removal guide included, is the outcome of extensive research, hard work and our team’s devotion to help you remove the specific, adware-related problem, and restore your browser and computer system.
How did we conduct the research on malware delivered by "World Health Organization (WHO)" e-mail scam?
Please note that our research is based on independent investigation. We are in contact with independent security researchers, thanks to which we receive daily updates on the latest malware, adware, and browser hijacker definitions.
Furthermore, the research behind the malware delivered by "World Health Organization (WHO)" e-mail scam threat is backed with VirusTotal.
To better understand this online threat, please refer to the following articles which provide knowledgeable details.