Many phishing campaigns have been detected to impersonate the World Health Organization (WHO). This time hackers are trying to take advantage of public concern over the coronavirus that is increasing each day worldwide. As reported, there are a few types of phishing emails that misuse the pandemic COVID-19 situation. However, the purpose of all these emails is to deliver malware on computer operating systems and make people victims of phishing schemes.
Our team identified that among the malicious programs propagated via “World Health Organization (WHO)” email scams are the reported HawkEye Trojan , GuLoader, Agent Tesla and Formbook. However, these may not be all malware proliferated by WHO phishing emails.
|Name||“World Health Organization (WHO)” E-mail Scam|
|Short Description||Aim to trick people into transferring BitCoins to hackers, installing malware, and providing sensitive credentials.|
|Symptoms||Messages pretend to be sent by the World Health Organization (WHO).|
|Distribution Method||Via massive spam campaigns.|
|Detection Tool|| See If Your System Has Been Affected by malware |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss malware delivered by "World Health Organization (WHO)" e-mail scam.|
So, if you receive an email sent by a supposedly World Health Organization representative, first verify the authenticity of this email and then decide whether to reply and follow the presented instructions or just move that email to the Trash.
Note that the World Health Organization (WHO) does not send emails from addresses ending in “@who.com”, “@who.org” or “@who-safety.org”. The only legitimate format used by the organization is @who.int If you notice any other symbol after the “@” symbol then consider the sender as a fraudster.
Types of “World Health Organization (WHO)” Email Scams
Currently, the main variants of the World Health Organization (WHO) email scam are four. Since the crisis situation is likely to grow further, the variants of these nasty phishing scams may increase as well.
Before we review the main four types of World Health Organization (WHO) email phishing campaigns, let’s summarize the purposes of their spread:
- 1. Money theft under the pretext that the organization needs donations to effectively battle the coronavirus crisis
2. Information gathering
3. Propagation of downloaders and info stealing Trojans like Agent Tesla, HawkEye, GuLoader, and Formbook.
”COVID-19 Solidarity Response Fund for WHO – DONATE NOW” Email Scam
This letter explains the purpose of the World Health Organization (WHO) and reveals the measures the organization is taking to battle the disastrous Coronavirus. Here is a copy of its text message:
World Health Organization
We are all affected by the growing COVID-19 pandemic.
It’s an unprecedented health challenge and we know people and organizations everywhere want to help.
The World Health Organization is leading and coordinating the global effort,
supporting countries to prevent, detect, and respond to the pandemic.
The greatest need right now is to help ensure all countries are prepared,
especially those with the weakest health systems.
Donations support WHOs work to track and understand the spread of the virus;
to ensure patients get the care they need and frontline workers get essential supplies and information;
and to accelerate efforts to develop vaccines, tests, and treatments.
See below for information on other ways to give, tax-deductibility and corporate and foundation giving options.
Now you can help us by donating any amount what you want help with the
Donate Now with Bitcoin payment.
World Health Organization bitcoin address(BTC Wallet) for
Online donations made via bitcoin are tax deductible in the U.S. and Europe.
To the extent allowable by law.
The World Health Organization accepts checks or wire transfers from
anywhere in the world.
World Health Organization doesn’t may to provide tax benefits to donors
to these payments.
Contact to email if you have any questions.
The primary goal of this email is to convince you to donate funds to support the WHO efforts against the Coronavirus. All donations are required in Bitcoin cryptocurrency. In reality, the presented details are related to cybercriminals’ crypto-wallets.
”Coronavirus disease (COVID-19) outbreak prevention and cure update“ Email Subject Line
This variant of the WHO email scam contains an attachment which as stated contains a list of easy to follow instructions and common medication that can be taken as a precaution against the Coronavirus. Here is what it states:
Please find the attached file with the instructions on comon drugs to take for prevention and fase cure to this deadly virus called
Coronavirus Disease (COVID-19).
This is an instruction from WHO (World Health Organization) to help fight agaisnt coronavirus.
NOTE : once received this mail review the attached file and follow the instructions .
please forward to your family members and friends to help us reach every one on how to fight
this virus , and the instructions are very simple and affordable.
Director WHO (World Health Organization)
Dr. Tedros Adhanom W.H.O
Veriforce and PEC Safety have merge. Learn more.
This e-mail is confidential and is intended solely for the use of the recipient. If you are not the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited.
Beware as the attached file, in fact, contains malicious software – a Trojan – that is called Agent Tesla RAT (Remote Access Trojan). The moment this Trojan accesses a target operating system, it can perform lots of malicious operations that will eventually enable it to steal sensitive credentials and let hackers enter remotely your device.
”W.H.O.”CORONAVIRUS(COV,19) SAFETY&PREVENTIVE MEASURES” Phishing Email
In this case, cybercriminals attempt to trick users into downloading and opening a malicious attachment on their PCs by claiming that the file contains healthy recommendations for everyday prevention steps against the virus. See its full message:
With regards to the ‘Medical Outbreak’ in the World due to Coronavirus (CoV) threatening to run riot all over the world; we know, this is a stressful time and we all want to know what we can do right now to protect ourselves and our families to prevent from getting exposed to this disease.
We at W.H.O(WORLD HEALTH ORGANIZATION), really care about the health & safety of all the people in the world, that is why we have highlighted/recommended in the attachment some everyday health and preparedness steps that the whole world can follow and be safe:
Hands and stones
The World Bank/Alejandro Lipszyc
For more information regarding Healthy Settings, please contact:
Interventions for Healthy Environments Unit (IHE)
Public Health and Environment Department (PHE)
World Health Organization
20 Avenue Appia
1211 Geneva 27
Fax No.: +41 22 791 13 83 Attention: Healthy Settings
”Latest on corona-virus” Scam Email
This email features an archived file attachment called My-health. As suggested in the email this file is an e-book that will help you learn important information about COVID-19 – its origin, different researches of the virus, transmission scenarios, protection and prevention tips and probably the most tempting one – adaptation instructions and emergency plans for national and local authorities. See a copy of the message of this email:
Concerning Corona-virus disease (COVID-19) outbreak, the World Health Organization brings you the Corona-virus E-Book and Guide.
Inside this E-Book (My-health), you shall find out the complete research/origin of corona-virus and the recommended guide to follow to protect yourself and others.
Guidance to protect children and business centre;
This guidance provides critical considerations and practical checklists to keep Kids and business centre safe. It also advises national and local authorities on how to adapt and implement emergency plans for educational facilities.
Critical preparedness, readiness and response actions for COVID-19;
WHO has defined four transmission scenarios for COVID-19. My Health E-book describes the preparedness, readiness and response for each transmission scenario.
Basic protective measures against the new corona-virus;
1. Stay aware with the most contented information on the COVID-19 outbreak, available on the E-Book attached to this mail and through your national and local public health authority.
2. Avoid touching Eyes, Nose and mouth
Why? Hands touch many surfaces and can pick up viruses. Once contaminated, hands can transfer the virus to your eyes, nose or mouth.
3. Practice respiratory hygiene
This will also protect you and help prevent the spread of viruses and other infections.
You can now download and access the attached My Health Zip file from a Windows Computer only.
You are receiving this email because your life count as everyone lives count. Sign up for more updates at the WHO website (www.who[.]int).
Thanks for helping to make the world a little healthier.
Instead of providing a useful book on how to be more aware of the Coronavirus and how to deal with it, the email delivers the nasty GuLoader malware that is a typical downloader. Once started on your machine, this malware enables hackers to download and install additional malicious programs like info stealers, ransomware, spyware, and so on.
How to Defend Yourself Against WHO Related Phishing Attempts
Here are the most important things to have in mind when and if you receive an email that is allegedly sent by the World Health Organization:
- 1. Ensure that the email sender is a real representative of the WHO. Look at the email address where you should find an email address that has the firstname.lastname@example.org pattern. All other combinations after the “@” symbol are evidence of a scam.
2. Do you see any links? Well, if yes, check them before you click them. All links that are related to the official WHO website start with https://www.who.int
3. Do not provide personal information and sensitive credentials to third-parties, not even to the WHO.
4. Try to not feel under pressure and don’t rush. Always take time to review the email details and consider whether you should act requested or not. Otherwise, you can easily provide your personal information to cybercriminals and online fraudsters.
5. Mistakes happen. If you fell victim to any of the WHO email scams or another online scam and gave sensitive information to fraudsters, don’t panic. What you should do is to immediately change your credentials on each site where you have used them. In the event that you provided some banking credentials make sure to call your bank and ask for appropriate assistance.
6. Report a scam, if you see it. The WHO is aware of the rising level of online threats that misuse their reputable name during this unfortunate for all of us, situation. They have opened a section on their official website where users can report various scams – here you can assess it – https://www.who.int/about/report_scam/en/
Remove Malware Delivered by “World Health Organization (WHO)” E-mail Scam from Your Computer
To remove any viruses related to “World Health Organization (WHO)” e-mail scam, then we suggest that you follow the steps below. They are suitable only if you know how to find it. For any other case, we strongly recommend automatic removal of malicious programs delivered by nasty e-mail scams. By using an advanced malware removal software you can delete automatically any malicious files and objects from your machine. This program has been created with the main idea to help you detect and get rid of any malicious files. Such a tool can protect your PC or Mac against future infections coming from scam mails as well.
- Guide 1: How to Remove malware delivered by "World Health Organization (WHO)" e-mail scam from Windows.
- Guide 2: Get rid of malware delivered by "World Health Organization (WHO)" e-mail scam from Mac OS X.
- Guide 3: Remove malware delivered by "World Health Organization (WHO)" e-mail scam from Google Chrome.
- Guide 4: Erase malware delivered by "World Health Organization (WHO)" e-mail scam from Mozilla Firefox.
- Guide 5: Uninstall malware delivered by "World Health Organization (WHO)" e-mail scam from Microsoft Edge.
- Guide 6: Remove malware delivered by "World Health Organization (WHO)" e-mail scam from Safari.
- Guide 7: Eliminate malware delivered by "World Health Organization (WHO)" e-mail scam from Internet Explorer.
How to Remove malware delivered by "World Health Organization (WHO)" e-mail scam from Windows.
Step 1: Boot Your PC In Safe Mode to isolate and remove malware delivered by "World Health Organization (WHO)" e-mail scam
Step 2: Uninstall malware delivered by "World Health Organization (WHO)" e-mail scam and related software from Windows
Here is a method in few easy steps that should be able to uninstall most programs. No matter if you are using Windows 10, 8, 7, Vista or XP, those steps will get the job done. Dragging the program or its folder to the recycle bin can be a very bad decision. If you do that, bits and pieces of the program are left behind, and that can lead to unstable work of your PC, errors with the file type associations and other unpleasant activities. The proper way to get a program off your computer is to Uninstall it.
Step 3: Clean any registries, created by malware delivered by "World Health Organization (WHO)" e-mail scam on your computer.
The usually targeted registries of Windows machines are the following:
You can access them by opening the Windows registry editor and deleting any values, created by malware delivered by "World Health Organization (WHO)" e-mail scam there. This can happen by following the steps underneath:
Get rid of malware delivered by "World Health Organization (WHO)" e-mail scam from Mac OS X.
Step 1: Uninstall malware delivered by "World Health Organization (WHO)" e-mail scam and remove related files and objects
1. Hit the ⇧+⌘+U keys to open Utilities. Another way is to click on “Go” and then click “Utilities”, like the image below shows:
- Go to Finder.
- In the search bar type the name of the app that you want to remove.
- Above the search bar change the two drop down menus to “System Files” and “Are Included” so that you can see all of the files associated with the application you want to remove. Bear in mind that some of the files may not be related to the app so be very careful which files you delete.
- If all of the files are related, hold the ⌘+A buttons to select them and then drive them to “Trash”.
In case you cannot remove malware delivered by "World Health Organization (WHO)" e-mail scam via Step 1 above:
In case you cannot find the virus files and objects in your Applications or other places we have shown above, you can manually look for them in the Libraries of your Mac. But before doing this, please read the disclaimer below:
You can repeat the same procedure with the following other Library directories:
Tip: ~ is there on purpose, because it leads to more LaunchAgents.
Step 2: Scan for and remove malware from your Mac
When you are facing problems on your Mac as a result of unwanted scripts, programs and malware, the recommended way of eliminating the threat is by using an anti-malware program. Combo Cleaner offers advanced security features along with other modules that will improve your Mac’s security and protect it in the future.
Remove malware delivered by "World Health Organization (WHO)" e-mail scam from Google Chrome.
Step 1: Start Google Chrome and open the drop menu
Step 2: Move the cursor over "Tools" and then from the extended menu choose "Extensions"
Step 3: From the opened "Extensions" menu locate the unwanted extension and click on its "Remove" button.
Step 4: After the extension is removed, restart Google Chrome by closing it from the red "X" button at the top right corner and start it again.
Erase malware delivered by "World Health Organization (WHO)" e-mail scam from Mozilla Firefox.
Step 1: Start Mozilla Firefox. Open the menu window
Step 2: Select the "Add-ons" icon from the menu.
Step 3: Select the unwanted extension and click "Remove"
Step 4: After the extension is removed, restart Mozilla Firefox by closing it from the red "X" button at the top right corner and start it again.
Uninstall malware delivered by "World Health Organization (WHO)" e-mail scam from Microsoft Edge.
Step 1: Start Edge browser.
Step 2: Open the drop menu by clicking on the icon at the top right corner.
Step 3: From the drop menu select "Extensions".
Step 4: Choose the suspected malicious extension you want to remove and then click on the gear icon.
Step 5: Remove the malicious extension by scrolling down and then clicking on Uninstall.
Remove malware delivered by "World Health Organization (WHO)" e-mail scam from Safari.
Step 1: Start the Safari app.
Step 2: After hovering your mouse cursor to the top of the screen, click on the Safari text to open its drop down menu.
Step 3: From the menu, click on "Preferences".
Step 4: After that, select the 'Extensions' Tab.
Step 5: Click once on the extension you want to remove.
Step 6: Click 'Uninstall'.
A pop-up window will appear asking for confirmation to uninstall the extension. Select 'Uninstall' again, and the malware delivered by "World Health Organization (WHO)" e-mail scam will be removed.
Eliminate malware delivered by "World Health Organization (WHO)" e-mail scam from Internet Explorer.
Step 1: Start Internet Explorer.
Step 2: Click on the gear icon labeled 'Tools' to open the drop menu and select 'Manage Add-ons'
Step 3: In the 'Manage Add-ons' window.
Step 4: Select the extension you want to remove and then click 'Disable'. A pop-up window will appear to inform you that you are about to disable the selected extension, and some more add-ons might be disabled as well. Leave all the boxes checked, and click 'Disable'.
Step 5: After the unwanted extension has been removed, restart Internet Explorer by closing it from the red 'X' button located at the top right corner and start it again.