A Fake Covid Vaccine SMS is the Latest COVID-19 Scam

India is going through a devastating second wave of the COVID-19 pandemic. There are shortages of critical medical supplies, as well as the vaccine. People are not getting slots for vaccination. As such, scammers are having a field day fooling gullible people. Now, a new Android malware is spreading through a fake Covid vaccine SMS, luring people to click on a link which is posing to be free Covid vaccine registration website.

A Dangerous Scam: Fake Covid Vaccine SMS

It looks like this malware is part of a larger organized campaign to scam people. In all the cases, vaccine registration website changes slightly, but the risk remains the same. When a user clicks on the website, the malware asks for access to contact, SMS on the phone along with other details.

Malware researcher at cybersecurity firm ESET Lukas Stefanko observed that this campaign started in April 2021, which is still ongoing in India.

He tweeted about the same to inform more people in late April.

https://twitter.com/LukasStefanko/status/1387733166195150849

Notably, the malware seems to have multiple names. These names include Covid-19 vaccine, Covid-19 vaccine registration, Vaccine Register, My-Vaci, among others.

Recently, the Indian Computer Emergency Response Team (CERT-In) also issued an advisory to warn citizens about  these malwares.

The firm mentioned that fake messages were circulating through SMS. These fake messages claim to offer an app to let users register for COVID-19 vaccine in India.

In all cases, the SMS asks users to install an app by clicking on a link. In its advisory, CERT-In also said, “the SMS message carries a link that installs the malicious app on Android based devices, which essentially spreads itself via SMS to victims' contacts. The app also gains unnecessary permissions that attackers could leverage to acquire user data such as contact list".