New Coronavirus Strain? Nope, Just Hackers Trying to Spread Malware

(Credit: NurPhoto via Getty.)

Received a random file about the coronavirus? It’s best to avoid opening it. Hackers are starting to exploit fears around the ongoing outbreak to infect computers with malware, according to security researchers.

The attacks have been occurring through files and emails that pretend to know something about the coronavirus, but have actually been designed to take over the victim’s computer.

On Wednesday, the hackers were spotted sending out spam emails to users in Japan, warning about a new strain of coronavirus reaching the island country, according(Opens in a new window) to IBM Security. The emails, which are written in Japanese, urge the recipient to open up the attached Word document to learn more.

If macros are enabled, the opened document will be able to execute a series of commands to secretly download the Emotet(Opens in a new window) malware, which can steal sensitive information from your machine or deliver other dangerous payloads, such as ransomware.

(The email pretends to come from a disability welfare service provider.)

“This new approach to delivering Emotet may be significantly more successful, due to the wide impact of the coronavirus and the fear of infection surrounding it,” IBM Security said in the report. “We expect to see more malicious email traffic based on the coronavirus in the future, as the infection spreads. This will probably include other languages too.”

On Thursday, the security firm Kaspersky Lab also reported uncovering malicious files disguised as documents about a new strain of coronavirus. To deliver the payload, the hackers were using PDFs, MP4 files and Word documents.

“The file names imply that they contain video instructions on how to protect yourself from the virus, updates on the threat and even virus detection procedures, which is not actually the case,” Kaspersky Lab said. In reality, the discovered files contained a range of different malware threats capable of destroying, blocking modifying and copying data on the victim’s machine.

“So far we have seen only 10 unique files, but as this sort of activity often happens with popular media topics, we expect that this tendency may grow,” said Kaspersky malware analyst Anton Ivanov in a statement. On Friday, the security firm updated the number of detected malicious files to 32.

Recommended by Our Editors

“The current number of infected users is not high enough to comprehensively know about the distribution methods of these files. But looking at previous cases, we can assume that users receive them from prepared attackers’ sites on the subject of coronavirus and via malicious email,” Kaspersky Lab told PCMag.

On Thursday, the World Health Organization formally declared(Opens in a new window) the coronavirus outbreak a public health emergency. China has publicly confirmed 7,711 cases and another 12,167 suspected cases while 170 people in the country have died from the illness.

Outside of China, the outbreak has reached 18 other countries including the US, which is now reporting six confirmed cases.

Editor’s Note: This story has been updated with more information from Kaspersky Lab.

Apple to restrict travel to China, close one store in relation to coronavirus