How to Not Fall Victim to “World Health Organization (WHO)” E-mail Scams

Many phishing campaigns have been detected to impersonate the World Health Organization (WHO). This time hackers are trying to take advantage of public concern over the coronavirus that is increasing each day worldwide. As reported, there are a few types of phishing emails that misuse the pandemic COVID-19 situation. However, the purpose of all these emails is to deliver malware on computer operating systems and make people victims of phishing schemes.

World Health Organization WHO Email Scams Coronavirus Malware

Our team identified that among the malicious programs propagated via “World Health Organization (WHO)” email scams are the reported HawkEye Trojan , GuLoader, Agent Tesla and Formbook. However, these may not be all malware proliferated by WHO phishing emails.

Threat Summary

Name“World Health Organization (WHO)” E-mail Scam
TypeE-Mail Scams
Short DescriptionAim to trick people into transferring BitCoins to hackers, installing malware, and providing sensitive credentials.
SymptomsMessages pretend to be sent by the World Health Organization (WHO).
Distribution MethodVia massive spam campaigns.
Detection Tool See If Your System Has Been Affected by malware


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss malware delivered by "World Health Organization (WHO)" e-mail scam.

So, if you receive an email sent by a supposedly World Health Organization representative, first verify the authenticity of this email and then decide whether to reply and follow the presented instructions or just move that email to the Trash.

Note that the World Health Organization (WHO) does not send emails from addresses ending in “”, “” or “”. The only legitimate format used by the organization is If you notice any other symbol after the “@” symbol then consider the sender as a fraudster.

Types of “World Health Organization (WHO)” Email Scams

Currently, the main variants of the World Health Organization (WHO) email scam are four. Since the crisis situation is likely to grow further, the variants of these nasty phishing scams may increase as well.

Before we review the main four types of World Health Organization (WHO) email phishing campaigns, let’s summarize the purposes of their spread:

    1. Money theft under the pretext that the organization needs donations to effectively battle the coronavirus crisis
    2. Information gathering
    3. Propagation of downloaders and info stealing Trojans like Agent Tesla, HawkEye, GuLoader, and Formbook.
In order for remote workers to be effectively protected, both they and their employers need to be aware of the security threats to look out for.
Beware: Fake Sites Promote Bogus Corona Antivirus, Install Malware

”COVID-19 Solidarity Response Fund for WHO – DONATE NOW” Email Scam

This letter explains the purpose of the World Health Organization (WHO) and reveals the measures the organization is taking to battle the disastrous Coronavirus. Here is a copy of its text message:

World Health Organization

We are all affected by the growing COVID-19 pandemic.
It’s an unprecedented health challenge and we know people and organizations everywhere want to help.
The World Health Organization is leading and coordinating the global effort,
supporting countries to prevent, detect, and respond to the pandemic.

The greatest need right now is to help ensure all countries are prepared,
especially those with the weakest health systems.
Donations support WHOs work to track and understand the spread of the virus;
to ensure patients get the care they need and frontline workers get essential supplies and information;
and to accelerate efforts to develop vaccines, tests, and treatments.

See below for information on other ways to give, tax-deductibility and corporate and foundation giving options.

Now you can help us by donating any amount what you want help with the

Donate Now with Bitcoin payment.

World Health Organization bitcoin address(BTC Wallet) for
Online donations made via bitcoin are tax deductible in the U.S. and Europe.
To the extent allowable by law.

The World Health Organization accepts checks or wire transfers from
anywhere in the world.
World Health Organization doesn’t may to provide tax benefits to donors
to these payments.

Contact to email if you have any questions.

The primary goal of this email is to convince you to donate funds to support the WHO efforts against the Coronavirus. All donations are required in Bitcoin cryptocurrency. In reality, the presented details are related to cybercriminals’ crypto-wallets.

Related: Coronavirus and STUXNET Worm or Why Control Is Important

”Coronavirus disease (COVID-19) outbreak prevention and cure update“ Email Subject Line

This variant of the WHO email scam contains an attachment which as stated contains a list of easy to follow instructions and common medication that can be taken as a precaution against the Coronavirus. Here is what it states:

Dear ********

Please find the attached file with the instructions on comon drugs to take for prevention and fase cure to this deadly virus called
Coronavirus Disease (COVID-19).

This is an instruction from WHO (World Health Organization) to help fight agaisnt coronavirus.
NOTE : once received this mail review the attached file and follow the instructions .
please forward to your family members and friends to help us reach every one on how to fight
this virus , and the instructions are very simple and affordable.

Best regard
Director WHO (World Health Organization)
Dr. Tedros Adhanom W.H.O

Veriforce and PEC Safety have merge. Learn more.

This e-mail is confidential and is intended solely for the use of the recipient. If you are not the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited.

Beware as the attached file, in fact, contains malicious software – a Trojan – that is called Agent Tesla RAT (Remote Access Trojan). The moment this Trojan accesses a target operating system, it can perform lots of malicious operations that will eventually enable it to steal sensitive credentials and let hackers enter remotely your device.

Related: Coronavirus and STUXNET Worm or Why Control Is Important


In this case, cybercriminals attempt to trick users into downloading and opening a malicious attachment on their PCs by claiming that the file contains healthy recommendations for everyday prevention steps against the virus. See its full message:

With regards to the ‘Medical Outbreak’ in the World due to Coronavirus (CoV) threatening to run riot all over the world; we know, this is a stressful time and we all want to know what we can do right now to protect ourselves and our families to prevent from getting exposed to this disease.

We at W.H.O(WORLD HEALTH ORGANIZATION), really care about the health & safety of all the people in the world, that is why we have highlighted/recommended in the attachment some everyday health and preparedness steps that the whole world can follow and be safe:

WHO Headquarters
Hands and stones
The World Bank/Alejandro Lipszyc

For more information regarding Healthy Settings, please contact:

Interventions for Healthy Environments Unit (IHE)
Public Health and Environment Department (PHE)
World Health Organization
20 Avenue Appia
1211 Geneva 27
Fax No.: +41 22 791 13 83 Attention: Healthy Settings

”Latest on corona-virus” Scam Email

This email features an archived file attachment called My-health. As suggested in the email this file is an e-book that will help you learn important information about COVID-19 – its origin, different researches of the virus, transmission scenarios, protection and prevention tips and probably the most tempting one – adaptation instructions and emergency plans for national and local authorities. See a copy of the message of this email:

Corona-virus updates
Concerning Corona-virus disease (COVID-19) outbreak, the World Health Organization brings you the Corona-virus E-Book and Guide.

Inside this E-Book (My-health), you shall find out the complete research/origin of corona-virus and the recommended guide to follow to protect yourself and others.

Guidance to protect children and business centre;

This guidance provides critical considerations and practical checklists to keep Kids and business centre safe. It also advises national and local authorities on how to adapt and implement emergency plans for educational facilities.

Critical preparedness, readiness and response actions for COVID-19;

WHO has defined four transmission scenarios for COVID-19. My Health E-book describes the preparedness, readiness and response for each transmission scenario.

Basic protective measures against the new corona-virus;

1. Stay aware with the most contented information on the COVID-19 outbreak, available on the E-Book attached to this mail and through your national and local public health authority.

2. Avoid touching Eyes, Nose and mouth
Why? Hands touch many surfaces and can pick up viruses. Once contaminated, hands can transfer the virus to your eyes, nose or mouth.

3. Practice respiratory hygiene
This will also protect you and help prevent the spread of viruses and other infections.

You can now download and access the attached My Health Zip file from a Windows Computer only.

You are receiving this email because your life count as everyone lives count. Sign up for more updates at the WHO website (www.who[.]int).

Thanks for helping to make the world a little healthier.

Instead of providing a useful book on how to be more aware of the Coronavirus and how to deal with it, the email delivers the nasty GuLoader malware that is a typical downloader. Once started on your machine, this malware enables hackers to download and install additional malicious programs like info stealers, ransomware, spyware, and so on.

Related: Coronavirus and Work: Avoid Cybersecurity Attacks While Working Remotely

How to Defend Yourself Against WHO Related Phishing Attempts

Here are the most important things to have in mind when and if you receive an email that is allegedly sent by the World Health Organization:

    1. Ensure that the email sender is a real representative of the WHO. Look at the email address where you should find an email address that has the pattern. All other combinations after the “@” symbol are evidence of a scam.

    2. Do you see any links? Well, if yes, check them before you click them. All links that are related to the official WHO website start with

    3. Do not provide personal information and sensitive credentials to third-parties, not even to the WHO.

    4. Try to not feel under pressure and don’t rush. Always take time to review the email details and consider whether you should act requested or not. Otherwise, you can easily provide your personal information to cybercriminals and online fraudsters.

    5. Mistakes happen. If you fell victim to any of the WHO email scams or another online scam and gave sensitive information to fraudsters, don’t panic. What you should do is to immediately change your credentials on each site where you have used them. In the event that you provided some banking credentials make sure to call your bank and ask for appropriate assistance.

    6. Report a scam, if you see it. The WHO is aware of the rising level of online threats that misuse their reputable name during this unfortunate for all of us, situation. They have opened a section on their official website where users can report various scams – here you can assess it –

Remove Malware Delivered by “World Health Organization (WHO)” E-mail Scam from Your Computer

To remove any viruses related to “World Health Organization (WHO)” e-mail scam, then we suggest that you follow the steps below. They are suitable only if you know how to find it. For any other case, we strongly recommend automatic removal of malicious programs delivered by nasty e-mail scams. By using an advanced malware removal software you can delete automatically any malicious files and objects from your machine. This program has been created with the main idea to help you detect and get rid of any malicious files. Such a tool can protect your PC or Mac against future infections coming from scam mails as well.

Gergana Ivanova

Gergana Ivanova

Gergana has a bachelor's degree in Marketing. She has been with the STF team for five years, researching malware, reporting on the latest computer infections, and following digital marketing trends.

More Posts

Follow Me:
Google Plus

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer

How to Remove malware delivered by "World Health Organization (WHO)" e-mail scam from Windows.

Step 1: Boot Your PC In Safe Mode to isolate and remove malware delivered by "World Health Organization (WHO)" e-mail scam


Manual Removal Usually Takes Time and You Risk Damaging Your Files If Not Careful!
We Recommend To Scan Your PC with SpyHunter

Keep in mind, that SpyHunter’s scanner is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware removal tool to remove the malware threats. Read our SpyHunter 5 review. Click on the corresponding links to check SpyHunter's EULA, Privacy Policy and Threat Assessment Criteria

1. Hold Windows key() + R

2. The "Run" Window will appear. In it, type "msconfig" and click OK.

3. Go to the "Boot" tab. There select "Safe Boot" and then click "Apply" and "OK".
Tip: Make sure to reverse those changes by unticking Safe Boot after that, because your system will always boot in Safe Boot from now on.

4. When prompted, click on "Restart" to go into Safe Mode.

5. You can recognise Safe Mode by the words written on the corners of your screen.

Step 2: Uninstall malware delivered by "World Health Organization (WHO)" e-mail scam and related software from Windows

Here is a method in few easy steps that should be able to uninstall most programs. No matter if you are using Windows 10, 8, 7, Vista or XP, those steps will get the job done. Dragging the program or its folder to the recycle bin can be a very bad decision. If you do that, bits and pieces of the program are left behind, and that can lead to unstable work of your PC, errors with the file type associations and other unpleasant activities. The proper way to get a program off your computer is to Uninstall it. To do that:

1. Hold the Windows Logo Button and "R" on your keyboard. A Pop-up window will appear.

2. In the field type in "appwiz.cpl" and press ENTER.

3. This will open a window with all the programs installed on the PC. Select the program that you want to remove, and press "Uninstall"
Follow the instructions above and you will successfully uninstall most programs.

Step 3: Clean any registries, created by malware delivered by "World Health Organization (WHO)" e-mail scam on your computer.

The usually targeted registries of Windows machines are the following:

  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

You can access them by opening the Windows registry editor and deleting any values, created by malware delivered by "World Health Organization (WHO)" e-mail scam there. This can happen by following the steps underneath:

1. Open the Run Window again, type "regedit" and click OK.

2. When you open it, you can freely navigate to the Run and RunOnce keys, whose locations are shown above.

3. You can remove the value of the virus by right-clicking on it and removing it.
Tip: To find a virus-created value, you can right-click on it and click "Modify" to see which file it is set to run. If this is the virus file location, remove the value.

Before starting "Step 4", please boot back into Normal mode, in case you are currently in Safe Mode.
This will enable you to install and use SpyHunter 5 successfully.

Step 4: Scan for malware delivered by "World Health Organization (WHO)" e-mail scam with SpyHunter Anti-Malware Tool

1. Click on the "Download" button to proceed to SpyHunter's download page.

It is recommended to run a scan before purchasing the full version of the software to make sure that the current version of the malware can be detected by SpyHunter. Click on the corresponding links to check SpyHunter's EULA, Privacy Policy and Threat Assessment Criteria.

2. After you have installed SpyHunter, wait for it to update automatically.


3. After the update process has finished, click on the 'Malware/PC Scan' tab. A new window will appear. Click on 'Start Scan'.


4. After SpyHunter has finished scanning your PC for any files of the associated threat and found them, you can try to get them removed automatically and permanently by clicking on the 'Next' button.


If any threats have been removed, it is highly recommended to restart your PC.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer

Get rid of malware delivered by "World Health Organization (WHO)" e-mail scam from Mac OS X.

Step 1: Uninstall malware delivered by "World Health Organization (WHO)" e-mail scam and remove related files and objects

Manual Removal Usually Takes Time and You Risk Damaging Your Files If Not Careful!
We Recommend To Scan Your Mac with SpyHunter for Mac
Keep in mind, that SpyHunter for Mac needs to purchased to remove the malware threats. Click on the corresponding links to check SpyHunter’s EULA and Privacy Policy

1. Hit the ⇧+⌘+U keys to open Utilities. Another way is to click on “Go” and then click “Utilities”, like the image below shows:

2. Find Activity Monitor and double-click it:

3. In the Activity Monitor look for any suspicious processes, belonging or related to malware delivered by "World Health Organization (WHO)" e-mail scam:

Tip: To quit a process completely, choose the “Force Quit” option.

4. Click on the "Go" button again, but this time select Applications. Another way is with the ⇧+⌘+A buttons.

5. In the Applications menu, look for any suspicious app or an app with a name, similar or identical to malware delivered by "World Health Organization (WHO)" e-mail scam. If you find it, right-click on the app and select “Move to Trash”.

6: Select Accounts, after which click on the Login Items preference. Your Mac will then show you a list of items that start automatically when you log in. Look for any suspicious apps identical or similar to malware delivered by "World Health Organization (WHO)" e-mail scam. Check the app you want to stop from running automatically and then select on the Minus (“-“) icon to hide it.

7: Remove any left-over files that might be related to this threat manually by following the sub-steps below:

  • Go to Finder.
  • In the search bar type the name of the app that you want to remove.
  • Above the search bar change the two drop down menus to “System Files” and “Are Included” so that you can see all of the files associated with the application you want to remove. Bear in mind that some of the files may not be related to the app so be very careful which files you delete.
  • If all of the files are related, hold the ⌘+A buttons to select them and then drive them to “Trash”.

In case you cannot remove malware delivered by "World Health Organization (WHO)" e-mail scam via Step 1 above:

In case you cannot find the virus files and objects in your Applications or other places we have shown above, you can manually look for them in the Libraries of your Mac. But before doing this, please read the disclaimer below:

Disclaimer! If you are about to tamper with Library files on Mac, be sure to know the name of the virus file, because if you delete the wrong file, it may cause irreversible damage to your MacOS. Continue on your own responsibility!

1: Click on "Go" and Then "Go to Folder" as shown underneath:

2: Type in "/Library/LauchAgents/" and click Ok:

3: Delete all of the virus files that have similar or the same name as malware delivered by "World Health Organization (WHO)" e-mail scam. If you believe there is no such file, do not delete anything.

You can repeat the same procedure with the following other Library directories:

→ ~/Library/LaunchAgents

Tip: ~ is there on purpose, because it leads to more LaunchAgents.

Step 2: Scan for and remove malware from your Mac

When you are facing problems on your Mac as a result of unwanted scripts, programs and malware, the recommended way of eliminating the threat is by using an anti-malware program. Combo Cleaner offers advanced security features along with other modules that will improve your Mac’s security and protect it in the future.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer

Remove malware delivered by "World Health Organization (WHO)" e-mail scam from Google Chrome.

Step 1: Start Google Chrome and open the drop menu

Step 2: Move the cursor over "Tools" and then from the extended menu choose "Extensions"

Step 3: From the opened "Extensions" menu locate the unwanted extension and click on its "Remove" button.

Step 4: After the extension is removed, restart Google Chrome by closing it from the red "X" button at the top right corner and start it again.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer

Erase malware delivered by "World Health Organization (WHO)" e-mail scam from Mozilla Firefox.

Step 1: Start Mozilla Firefox. Open the menu window

Step 2: Select the "Add-ons" icon from the menu.

Step 3: Select the unwanted extension and click "Remove"

Step 4: After the extension is removed, restart Mozilla Firefox by closing it from the red "X" button at the top right corner and start it again.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer

Uninstall malware delivered by "World Health Organization (WHO)" e-mail scam from Microsoft Edge.

Step 1: Start Edge browser.

Step 2: Open the drop menu by clicking on the icon at the top right corner.

Step 3: From the drop menu select "Extensions".

Step 4: Choose the suspected malicious extension you want to remove and then click on the gear icon.

Step 5: Remove the malicious extension by scrolling down and then clicking on Uninstall.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer

Remove malware delivered by "World Health Organization (WHO)" e-mail scam from Safari.

Step 1: Start the Safari app.

Step 2: After hovering your mouse cursor to the top of the screen, click on the Safari text to open its drop down menu.

Step 3: From the menu, click on "Preferences".

stf-safari preferences

Step 4: After that, select the 'Extensions' Tab.


Step 5: Click once on the extension you want to remove.

Step 6: Click 'Uninstall'.

stf-safari uninstall

A pop-up window will appear asking for confirmation to uninstall the extension. Select 'Uninstall' again, and the malware delivered by "World Health Organization (WHO)" e-mail scam will be removed.

How to Reset Safari
IMPORTANT: Before resetting Safari make sure you back up all your saved passwords within the browser in case you forget them.

Start Safari and then click on the gear leaver icon.

Click the Reset Safari button and you will reset the browser.

Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer

Eliminate malware delivered by "World Health Organization (WHO)" e-mail scam from Internet Explorer.

Step 1: Start Internet Explorer.

Step 2: Click on the gear icon labeled 'Tools' to open the drop menu and select 'Manage Add-ons'

Step 3: In the 'Manage Add-ons' window.

Step 4: Select the extension you want to remove and then click 'Disable'. A pop-up window will appear to inform you that you are about to disable the selected extension, and some more add-ons might be disabled as well. Leave all the boxes checked, and click 'Disable'.

Step 5: After the unwanted extension has been removed, restart Internet Explorer by closing it from the red 'X' button located at the top right corner and start it again.

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share