The coronavirus pandemic continues to spread rapidly. So far, the virus has infected 153,000 people and claimed the lives of 5,800 people worldwide. And while the situation has spread fear, malicious actors are trying to exploit the prevailing climate of insecurity to infect smartphones with the Covidlock ransomware .
According to security firm DomainTools, a website promises to offer authoritative information about coronavirus cases through Android app, but in reality installs Covidlock ransomware.
The website, known as “coronavirusapp[.] Site,” touts certifications from the World Health Organization (WHO) and the Centers for Disease Control and Prevention (CDC). It also claims that its app has over 6 million reviews and a 4.4-star rating.
The app promises to send notifications to the user when it detects a coronavirus case near their area. However, once the user installs the app and grants permission for various permissions on their device, they are attacked by Covidlock, which forces them to change their screen lock.
The victim then receives a message giving them 48 hours to pay the ransom. The message threatens the user that if they don’t pay in time, they will erase all data from their device and also leak their social media . The amount the hackers are asking for is $100 in bitcoin.
So far, there has been no reported case of the ransom being paid. In the meantime, the security firm claims to have used reverse engineering to discover the decryption keys and plans to publish them soon.
Of course, this is not the only incident that exploits the current state of fear. A few days ago, a fake coronavirus tracking map was released that installed malware on computers to steal passwords.
DomainTools notes that an alarming number of domainsare being registered around the coronavirus. “These registrations have increased significantly in recent weeks, and many of them are scams.”
A similar incident recently occurred in Iran, where an app promised to notify people if they had contracted the coronavirus, but in reality, what it did was collect the location data of Iranian citizens.
