Many phishing campaigns have been detected to impersonate the World Health Organization (WHO). This time hackers are trying to take advantage of public concern over the coronavirus that is increasing each day worldwide. As reported, there are a few types of phishing emails that misuse the pandemic COVID-19 situation. However, the purpose of all these emails is to deliver malware on computer operating systems and make people victims of phishing schemes.
Our team identified that among the malicious programs propagated via “World Health Organization (WHO)” email scams are the reported HawkEye Trojan , GuLoader, Agent Tesla and Formbook. However, these may not be all malware proliferated by WHO phishing emails.
|“World Health Organization (WHO)” E-mail Scam
|Aim to trick people into transferring BitCoins to hackers, installing malware, and providing sensitive credentials.
|Messages pretend to be sent by the World Health Organization (WHO).
|Via massive spam campaigns.
See If Your System Has Been Affected by malware
Malware Removal Tool
|Join Our Forum to Discuss malware delivered by "World Health Organization (WHO)" e-mail scam.
So, if you receive an email sent by a supposedly World Health Organization representative, first verify the authenticity of this email and then decide whether to reply and follow the presented instructions or just move that email to the Trash.
Note that the World Health Organization (WHO) does not send emails from addresses ending in “@who.com”, “@who.org” or “@who-safety.org”. The only legitimate format used by the organization is @who.int If you notice any other symbol after the “@” symbol then consider the sender as a fraudster.
Types of “World Health Organization (WHO)” Email Scams
Currently, the main variants of the World Health Organization (WHO) email scam are four. Since the crisis situation is likely to grow further, the variants of these nasty phishing scams may increase as well.
Before we review the main four types of World Health Organization (WHO) email phishing campaigns, let’s summarize the purposes of their spread:
- 1. Money theft under the pretext that the organization needs donations to effectively battle the coronavirus crisis
2. Information gathering
3. Propagation of downloaders and info stealing Trojans like Agent Tesla, HawkEye, GuLoader, and Formbook.
”COVID-19 Solidarity Response Fund for WHO – DONATE NOW” Email Scam
This letter explains the purpose of the World Health Organization (WHO) and reveals the measures the organization is taking to battle the disastrous Coronavirus. Here is a copy of its text message:
World Health Organization
We are all affected by the growing COVID-19 pandemic.
It’s an unprecedented health challenge and we know people and organizations everywhere want to help.
The World Health Organization is leading and coordinating the global effort,
supporting countries to prevent, detect, and respond to the pandemic.
The greatest need right now is to help ensure all countries are prepared,
especially those with the weakest health systems.
Donations support WHOs work to track and understand the spread of the virus;
to ensure patients get the care they need and frontline workers get essential supplies and information;
and to accelerate efforts to develop vaccines, tests, and treatments.
See below for information on other ways to give, tax-deductibility and corporate and foundation giving options.
Now you can help us by donating any amount what you want help with the
Donate Now with Bitcoin payment.
World Health Organization bitcoin address(BTC Wallet) for
Online donations made via bitcoin are tax deductible in the U.S. and Europe.
To the extent allowable by law.
The World Health Organization accepts checks or wire transfers from
anywhere in the world.
World Health Organization doesn’t may to provide tax benefits to donors
to these payments.
Contact to email if you have any questions.
The primary goal of this email is to convince you to donate funds to support the WHO efforts against the Coronavirus. All donations are required in Bitcoin cryptocurrency. In reality, the presented details are related to cybercriminals’ crypto-wallets.
”Coronavirus disease (COVID-19) outbreak prevention and cure update“ Email Subject Line
This variant of the WHO email scam contains an attachment which as stated contains a list of easy to follow instructions and common medication that can be taken as a precaution against the Coronavirus. Here is what it states:
Please find the attached file with the instructions on comon drugs to take for prevention and fase cure to this deadly virus called
Coronavirus Disease (COVID-19).
This is an instruction from WHO (World Health Organization) to help fight agaisnt coronavirus.
NOTE : once received this mail review the attached file and follow the instructions .
please forward to your family members and friends to help us reach every one on how to fight
this virus , and the instructions are very simple and affordable.
Director WHO (World Health Organization)
Dr. Tedros Adhanom W.H.O
Veriforce and PEC Safety have merge. Learn more.
This e-mail is confidential and is intended solely for the use of the recipient. If you are not the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited.
Beware as the attached file, in fact, contains malicious software – a Trojan – that is called Agent Tesla RAT (Remote Access Trojan). The moment this Trojan accesses a target operating system, it can perform lots of malicious operations that will eventually enable it to steal sensitive credentials and let hackers enter remotely your device.
”W.H.O.”CORONAVIRUS(COV,19) SAFETY&PREVENTIVE MEASURES” Phishing Email
In this case, cybercriminals attempt to trick users into downloading and opening a malicious attachment on their PCs by claiming that the file contains healthy recommendations for everyday prevention steps against the virus. See its full message:
With regards to the ‘Medical Outbreak’ in the World due to Coronavirus (CoV) threatening to run riot all over the world; we know, this is a stressful time and we all want to know what we can do right now to protect ourselves and our families to prevent from getting exposed to this disease.
We at W.H.O(WORLD HEALTH ORGANIZATION), really care about the health & safety of all the people in the world, that is why we have highlighted/recommended in the attachment some everyday health and preparedness steps that the whole world can follow and be safe:
Hands and stones
The World Bank/Alejandro Lipszyc
For more information regarding Healthy Settings, please contact:
Interventions for Healthy Environments Unit (IHE)
Public Health and Environment Department (PHE)
World Health Organization
20 Avenue Appia
1211 Geneva 27
Fax No.: +41 22 791 13 83 Attention: Healthy Settings
”Latest on corona-virus” Scam Email
This email features an archived file attachment called My-health. As suggested in the email this file is an e-book that will help you learn important information about COVID-19 – its origin, different researches of the virus, transmission scenarios, protection and prevention tips and probably the most tempting one – adaptation instructions and emergency plans for national and local authorities. See a copy of the message of this email:
Concerning Corona-virus disease (COVID-19) outbreak, the World Health Organization brings you the Corona-virus E-Book and Guide.
Inside this E-Book (My-health), you shall find out the complete research/origin of corona-virus and the recommended guide to follow to protect yourself and others.
Guidance to protect children and business centre;
This guidance provides critical considerations and practical checklists to keep Kids and business centre safe. It also advises national and local authorities on how to adapt and implement emergency plans for educational facilities.
Critical preparedness, readiness and response actions for COVID-19;
WHO has defined four transmission scenarios for COVID-19. My Health E-book describes the preparedness, readiness and response for each transmission scenario.
Basic protective measures against the new corona-virus;
1. Stay aware with the most contented information on the COVID-19 outbreak, available on the E-Book attached to this mail and through your national and local public health authority.
2. Avoid touching Eyes, Nose and mouth
Why? Hands touch many surfaces and can pick up viruses. Once contaminated, hands can transfer the virus to your eyes, nose or mouth.
3. Practice respiratory hygiene
This will also protect you and help prevent the spread of viruses and other infections.
You can now download and access the attached My Health Zip file from a Windows Computer only.
You are receiving this email because your life count as everyone lives count. Sign up for more updates at the WHO website (www.who[.]int).
Thanks for helping to make the world a little healthier.
Instead of providing a useful book on how to be more aware of the Coronavirus and how to deal with it, the email delivers the nasty GuLoader malware that is a typical downloader. Once started on your machine, this malware enables hackers to download and install additional malicious programs like info stealers, ransomware, spyware, and so on.
How to Defend Yourself Against WHO Related Phishing Attempts
Here are the most important things to have in mind when and if you receive an email that is allegedly sent by the World Health Organization:
- 1. Ensure that the email sender is a real representative of the WHO. Look at the email address where you should find an email address that has the email@example.com pattern. All other combinations after the “@” symbol are evidence of a scam.
2. Do you see any links? Well, if yes, check them before you click them. All links that are related to the official WHO website start with https://www.who.int
3. Do not provide personal information and sensitive credentials to third-parties, not even to the WHO.
4. Try to not feel under pressure and don’t rush. Always take time to review the email details and consider whether you should act requested or not. Otherwise, you can easily provide your personal information to cybercriminals and online fraudsters.
5. Mistakes happen. If you fell victim to any of the WHO email scams or another online scam and gave sensitive information to fraudsters, don’t panic. What you should do is to immediately change your credentials on each site where you have used them. In the event that you provided some banking credentials make sure to call your bank and ask for appropriate assistance.
6. Report a scam, if you see it. The WHO is aware of the rising level of online threats that misuse their reputable name during this unfortunate for all of us, situation. They have opened a section on their official website where users can report various scams – here you can assess it – https://www.who.int/about/report_scam/en/
Remove Malware Delivered by “World Health Organization (WHO)” E-mail Scam from Your Computer
To remove any viruses related to “World Health Organization (WHO)” e-mail scam, then we suggest that you follow the steps below. They are suitable only if you know how to find it. For any other case, we strongly recommend automatic removal of malicious programs delivered by nasty e-mail scams. By using an advanced malware removal software you can delete automatically any malicious files and objects from your machine. This program has been created with the main idea to help you detect and get rid of any malicious files. Such a tool can protect your PC or Mac against future infections coming from scam mails as well.
malware delivered by "World Health Organization (WHO)" e-mail scam-FAQ
What Is malware delivered by "World Health Organization (WHO)" e-mail scam?
The malware delivered by "World Health Organization (WHO)" e-mail scam threat is adware or browser redirect virus.
It may slow your computer down significantly and display advertisements. The main idea is for your information to likely get stolen or more ads to appear on your device.
The creators of such unwanted apps work with pay-per-click schemes to get your computer to visit risky or different types of websites that may generate them funds. This is why they do not even care what types of websites show up on the ads. This makes their unwanted software indirectly risky for your OS.
What Are the Symptoms of malware delivered by "World Health Organization (WHO)" e-mail scam?
There are several symptoms to look for when this particular threat and also unwanted apps in general are active:
Symptom #1: Your computer may become slow and have poor performance in general.
Symptom #2: You have toolbars, add-ons or extensions on your web browsers that you don't remember adding.
Symptom #3: You see all types of ads, like ad-supported search results, pop-ups and redirects to randomly appear.
Symptom #4: You see installed apps on your Mac running automatically and you do not remember installing them.
Symptom #5: You see suspicious processes running in your Task Manager.
If you see one or more of those symptoms, then security experts recommend that you check your computer for viruses.
What Types of Unwanted Programs Are There?
According to most malware researchers and cyber-security experts, the threats that can currently affect your device can be rogue antivirus software, adware, browser hijackers, clickers, fake optimizers and any forms of PUPs.
What to Do If I Have a "virus" like malware delivered by "World Health Organization (WHO)" e-mail scam?
With few simple actions. First and foremost, it is imperative that you follow these steps:
Step 1: Find a safe computer and connect it to another network, not the one that your Mac was infected in.
Step 2: Change all of your passwords, starting from your email passwords.
Step 3: Enable two-factor authentication for protection of your important accounts.
Step 4: Call your bank to change your credit card details (secret code, etc.) if you have saved your credit card for online shopping or have done online activities with your card.
Step 5: Make sure to call your ISP (Internet provider or carrier) and ask them to change your IP address.
Step 6: Change your Wi-Fi password.
Step 7: (Optional): Make sure to scan all of the devices connected to your network for viruses and repeat these steps for them if they are affected.
Step 8: Install anti-malware software with real-time protection on every device you have.
Step 9: Try not to download software from sites you know nothing about and stay away from low-reputation websites in general.
If you follow these recommendations, your network and all devices will become significantly more secure against any threats or information invasive software and be virus free and protected in the future too.
How Does malware delivered by "World Health Organization (WHO)" e-mail scam Work?
Once installed, malware delivered by "World Health Organization (WHO)" e-mail scam can collect data using trackers. This data is about your web browsing habits, such as the websites you visit and the search terms you use. It is then used to target you with ads or to sell your information to third parties.
malware delivered by "World Health Organization (WHO)" e-mail scam can also download other malicious software onto your computer, such as viruses and spyware, which can be used to steal your personal information and show risky ads, that may redirect to virus sites or scams.
Is malware delivered by "World Health Organization (WHO)" e-mail scam Malware?
The truth is that PUPs (adware, browser hijackers) are not viruses, but may be just as dangerous since they may show you and redirect you to malware websites and scam pages.
Many security experts classify potentially unwanted programs as malware. This is because of the unwanted effects that PUPs can cause, such as displaying intrusive ads and collecting user data without the user’s knowledge or consent.
About the malware delivered by "World Health Organization (WHO)" e-mail scam Research
The content we publish on SensorsTechForum.com, this malware delivered by "World Health Organization (WHO)" e-mail scam how-to removal guide included, is the outcome of extensive research, hard work and our team’s devotion to help you remove the specific, adware-related problem, and restore your browser and computer system.
How did we conduct the research on malware delivered by "World Health Organization (WHO)" e-mail scam?
Please note that our research is based on independent investigation. We are in contact with independent security researchers, thanks to which we receive daily updates on the latest malware, adware, and browser hijacker definitions.
Furthermore, the research behind the malware delivered by "World Health Organization (WHO)" e-mail scam threat is backed with VirusTotal.
To better understand this online threat, please refer to the following articles which provide knowledgeable details.