Coronavirus scammers are seeking to profit off the deadly virus

The new coronavirus has been a bonanza for scammers and spies, who are exploiting the global thirst for information about the outbreak to make money and steal information, government officials and cybersecurity experts say.

Criminal hackers, scammers and even governments have been sending fake coronavirus-themed emails designed to trick people into opening attachments that download malicious software, allowing access to their data, experts told NBC News. Some messages have impersonated the World Health Organization and the Centers for Disease Control and Prevention, while others have masqueraded as communications from health authorities in other countries, including Ukraine, Vietnam and Italy.

The FBI is tracking so-called phishing campaigns that seek to use people's interest in the coronavirus to get them to click on links that encourage them to reveal sensitive login information, a top FBI official said.

"One of the things that's most concerning to us are phishing scams with a coronavirus theme," said Herb Stapleton, a section chief in the FBI's cyber criminal section. "This is a vector or an approach that we didn't see three months ago and now is suddenly successful."

Full coverage of the coronavirus outbreak

People can report bogus emails to the FBI by going to www.ic3.gov, Stapleton said.

Sophos, a global security company, provided NBC News with examples of the phishing scams, including one offering information purported to be from the World Health Organization.

Image: Fake WHO emailA fake email has the logo of the World Health Organization on it. Sophos Ltd.

The coronavirus phishing scam, which has been around since early February, has targeted users around the world. Police departments from Australia to the U.K. have issued warnings to be on the lookout for it.

The WHO also issued its own guidance making it clear that it would never "ask you to login to view safety information."

A newer and lesser-known scam has recently been uncovered by Sophos: emails purporting to be from CDC doctors and U.N. officials that encourage users to download malicious files.

"A must read," says one bogus email purported to be from a CDC doctor, which the company showed to NBC News. "Find in the attached everything you need to know about the spreading and management of the deadly Wuhan Coronavirus…"

Download the NBC News app for full coverage of the coronavirus outbreak

If a person clicks on one of the attachments promising guidance on how to "help prevent the coronavirus," malware will be downloaded onto the unsuspecting user's device. One malware package, called "Trickbot," typically tries to steal banking credentials, and the other, named "Fareit," which can log a person's keystrokes, typically tries to steal any and all login credentials.

"In volume, the malicious ones are a fraction of the total number of things trying to take advantage of the coronavirus, but obviously they are the ones we worry about the most because they are the ones that cause harm," said Chester Wisniewski, a research scientist with Sophos.

Cybercriminals "recognize that when there is a crisis, people are hungry for information — they are looking for whatever is new," said Shawn Henry, who once headed the FBI's cyber division and now works for a security firm, CrowdStrike.

39 PHOTOS
Coronavirus outbreak in the U.S.
See Gallery
Coronavirus outbreak in the U.S.
Vice President Mike Pence points to a question as he speaks during a briefing about the coronavirus in the James Brady Press Briefing Room of the White House, Sunday, March 15, 2020, in Washington. (AP Photo/Alex Brandon)
Tyler Baldwin mops the floor after closing for the night at the Taproom at Pike Place, Sunday, March 15, 2020 where he works as a bartender in Seattle. Washington Gov. Jay Inslee said Sunday night that he would order all bars, restaurants, entertainment and recreation facilities in the state to temporarily close to fight the spread of coronavirus, as Washington state has by far the most deaths in the U.S. from the disease. Baldwin said he closed more than an hour early Sunday after he heard the announcement. (AP Photo/Ted S. Warren)
A freeway sign urging people to wash their hands to avoid the COVID-19 virus is seen along the 101 Ventura freeway Sunday, March 15, 2020, in Westlake Village, Calif. (AP Photo/Mark J. Terrill)
Shelves are emptied of paper toilet and product supplies at a Safeway store in Phoenix on Sunday, March 15, 2020. Arizona's governor and school superintendent on Sunday ordered a statewide closure of schools through at least March 27 as authorities rush to contain the outbreak of the new coronavirus. (AP Photo/Brian Skoloff)
A store vendor wears a face mask as she waits for customers in Chinatown in New York, on Sunday, March 15, 2020. President Donald Trump on Sunday called on Americans to cease hoarding groceries and other supplies, while one of the nation's most senior public health officials called on the nation to act with more urgency to safeguard their health as the coronavirus outbreak continued to spread across the United States.(AP Photo/Wong Maye-E)
Workers from a Servpro disaster recovery team wearing protective suits and respirators are given supplies as they line up before entering the Life Care Center in Kirkland, Wash., to begin cleaning and disinfecting the facility, Wednesday, March 11, 2020. The nursing home is at the center of the coronavirus outbreak in Washington state. For most people, the virus causes only mild or moderate symptoms. For some it can cause more severe illness, especially in older adults and people with existing health problems. (AP Photo/Ted S. Warren)
March 11th 2020 - Tom Hanks and Rita Wilson have tested positive for the novel coronavirus. - File Photo by: zz/KGC-11/STAR MAX/IPx 2016 9/9/16 Tom Hanks and Rita Wilson at The 5th Biennial Stand Up To Cancer (SU2C). (Los Angeles, CA)
NBA referee Marc Davis, left, takes a phone call as fellow referee Justin Van Duyne stands next to Davis before the basketball game between the New Orleans Pelicans and Sacramento Kings was postponed at the last minute in Sacramento, Calif., Wednesday, March 11, 2020. The league said the decision was made out of an "abundance of caution," because official Courtney Kirkland, who was scheduled to work the game, had worked the Utah Jazz game earlier in the week. A player for the Jazz tested positive for the coronavirus. (AP Photo/Rich Pedroncelli)
NBA referee Marc Davis leaves the court after the the NBA basketball game between the Sacramento Kings and the New Orleans Pelicans was postponed at the last minute in Sacramento, Calif., Wednesday, March 11, 2020. The postponement was due to what the league said was an "abundance of caution," because official Courtney Kirkland, who was scheduled to work the game, had worked the Utah Jazz game earlier in the week. A player for the Jazz tested positive for the coronavirus. (AP Photo/Rich Pedroncelli)
From left Ellie Unruh, Abbie Unruh, Zoe Yates, and Evi Yates bump elbows instead of high-fives while playing volleyball at a local park Sunday, March 15, 2020, in Gilbert, Ariz. The girls were playing with friends after their respective volleyball clubs and teams practices and games were canceled statewide due to the COVID-19 coronavirus. Arizona Gov. Doug Ducey announced earlier in the day that all schools and sports throughout Arizona are temporarily closed through March 27th challenging some parents to get creative in keeping their kids active. (AP Photo/Matt York)
A basketball fan walks past a sign on how to decrease the risk of catching the coronavirus outside a restroom at the American Airlines Arena during the first half of an NBA basketball game between the Miami Heat and the Charlotte Hornets, Wednesday, March 11, 2020, in Miami. (AP Photo/Wilfredo Lee)
President Donald Trump speaks in an address to the nation from the Oval Office at the White House about the coronavirus Wednesday, March, 11, 2020, in Washington. (Doug Mills/The New York Times via AP, Pool)
FILE PHOTO: Voters cast their ballot in the Democratic primary election in Houston
A trader works on the floor at the New York Stock Exchange (NYSE) in New York City, New York
Judie Shape, left, who has tested positive for the coronavirus, waves to her daughter, Lori Spencer, right, Wednesday, March 11, 2020, as they visit on the phone and look at each other through a window at the Life Care Center in Kirkland, Wash., near Seattle. In-person visits are not allowed at the nursing home. The vast majority of people recover from the new coronavirus. According to the World Health Organization, most people recover in about two to six weeks, depending on the severity of the illness. (AP Photo/Ted S. Warren)
Judie Shape, center, who has tested positive for the coronavirus, blows a kiss to her son-in-law, Michael Spencer, left, as Shape's daughter, Lori Spencer, right, looks on, Wednesday, March 11, 2020, as they visit on the phone and look at each other through a window at the Life Care Center in Kirkland, Wash., near Seattle. In-person visits are not allowed at the nursing home. The vast majority of people recover from the new coronavirus. According to the World Health Organization, most people recover in about two to six weeks, depending on the severity of the illness. (AP Photo/Ted S. Warren)
As President Donald Trump listens, Vice President Mike Pence speaks in the briefing room of the White House in Washington, Monday, March, 9, 2020, about the coronavirus outbreak. (AP Photo/Carolyn Kaster)
Yirmeyahu Gourarie performs a Purim reading from the Book of Esther for residents under self-quarantine due to potential exposure to the new coronavirus, Monday, March 9, 2020, in New Rochelle, N.Y. In Westchester County, student volunteers from a Jewish secondary school were fanning out in teams to read the megillah on Monday evening and during the day Tuesday outside the homes of about 120 families from the community who are quarantined. (AP Photo/John Minchillo)
This March 9, 2020, image provided by Carolyn Wright, a passenger aboard the Grand Princess, shows the disembarkation of the passengers from the cruise ship which is docked in Oakland, Ca. For most people, the new coronavirus causes only mild or moderate symptoms, such as fever and cough. For some, especially older adults and people with existing health problems, it can cause more severe illness, including pneumonia. (Courtesy of Carolyn Wright via AP)
Tim Killian, center, a spokesman for Life Care Center in Kirkland, Wash., talks to reporters, Monday, March 9, 2020, at the facility near Seattle. The nursing home is at the center of the outbreak of COVID-19 in Washington state. (AP Photo/Ted S. Warren)
A sign stands next to a sanitizing station at the entrance of the Vivint Smart Home Arena before an NBA basketball game between the Toronto Raptors and the Utah Jazz, Monday, March 9, 2020, in Salt Lake City. (AP Photo/Rick Bowmer)
Workers prepare a wharf at the Port of Oakland to receive the Grand Princess in Oakland, Calif., Sunday, March 8, 2020. The cruise ship, miles off the port Sunday, is expected to dock Monday for novel coronavirus quarantine after multiple people tested positive for the virus. (AP Photo/Noah Berger)
En esta imagen tomada de un video cortesía de la Guardia Nacional de California, un helicóptero del 129no batallón de rescate sobrevuela el crucero Gran Princess frente a las costas de California, el jueves 5 de marzo de 2020. (Guardia Nacional de California vía AP)
In this image from video, provided by the California National Guard, airmen with the 129th Rescue Wing drop virus testing kits down to the Grand Princess cruise ship off the coast of California Thursday, March 5, 2020. Scrambling to keep the coronavirus at bay, officials ordered a cruise ship with 3,500 people aboard to stay back from the California coast Thursday until passengers and crew can be tested, after a traveler from its previous voyage died of the disease and at least two others became infected. The California National Guard 129th Rescue Wing lowered test kits onto the 951-foot (290-meter) Grand Princess by rope as the vessel lay at anchor off Northern California, and authorities said the results would be available on Friday. Princess Cruise Lines said fewer than 100 people aboard had been identified for testing. (California National Guard via AP)
Passengers look out from balconies aboard the Grand Princess as it cruises a holding pattern about 25 miles off the coast of San Francisco on Sunday, March 8, 2020. The ship is expected to dock in Oakland in the east San Francisco Bay on Monday. California Gov. Gavin Newsom and the mayor of Oakland sought Sunday to reassure the public that none of the passengers from the ship with multiple cases of the new coronavirus will be released into the public before undergoing a 14-day quarantine. (AP Photo/Noah Berger)
Carrying multiple people who have tested positive for COVID-19, the Grand Princess maintains a holding pattern about 30 miles off the coast of San Francisco, Sunday, March 8, 2020. The cruise ship is scheduled to dock at the Port of Oakland on Monday. (AP Photo/Noah Berger)
A man wears a mask aboard the Grand Princess as it maintains a holding pattern about 25 miles off the coast of San Francisco on Sunday, March 8, 2020. The cruise ship is scheduled to dock at the Port of Oakland on Monday for COVID-19 quarantine after 21 people tested positive for the virus. (AP Photo/Noah Berger)
SPRINGFIELD, VA - MARCH 7: Local Target store in the D.C area depleted of cleaning and sanitizing supplies and left with empty shelves as fear grow of COVID-19 (the coronavirus) reports increasing on March 7, 2020 in Springfield, Virginia. Credit: mpi34/MediaPunch /IPX
SPRINGFIELD, VA - MARCH 7: Local Target store in the D.C area depleted of cleaning and sanitizing supplies and left with empty shelves as fear grow of COVID-19 (the coronavirus) reports increasing on March 7, 2020 in Springfield, Virginia. Credit: mpi34/MediaPunch /IPX
The headquarters for Centers for Disease Control and Prevention is shown on Friday, March 6, 2020 in Atlanta, Georgia. President Donald Trump's trip to the Centers for Disease Control and Prevention, briefly scuttled Friday because of unfounded fears that someone there had contracted the coronavirus, was back on, giving the president another chance to calm growing alarm about the spread of the virus in America. (AP Photo/ Ron Harris)
An ambulance backs into a parking lot, Friday, March 6, 2020, at the Life Care Center in Kirkland, Wash., which has become the epicenter of the COVID-19 coronavirus outbreak in Washington state. This ambulance left the facility after a short time and did not transport a patient. (AP Photo/Ted S. Warren)
Ambulance workers move a man on a stretcher from the Life Care Center in Kirkland, Wash. into an ambulance, Friday, March 6, 2020. The facility is the epicenter of the outbreak of the the COVID-19 coronavirus in Washington state. (AP Photo/Ted S. Warren)
A woman uses protective gloves as she looks at her phone wrapped in a plastic bag while riding a New York City subway train, Monday, March 9, 2020. (AP Photo/Richard Drew)
Secretary of Health and Human Services Alex Azar looks on as President Donald Trump shows a spending bill to combat the Coronavirus, at the White House, Friday, March 6, 2020, in Washington. (AP Photo/Evan Vucci)
President Donald Trump holds a photograph of coronavirus as Dr. Steve Monroe,right, with CDC speaks to members of the press at the headquarters of the Centers for Disease Control and Prevention in Atlanta on Friday, March 6, 2020. President Trump's trip to the Centers for Disease Control and Prevention, briefly scuttled Friday because of unfounded fears that someone there had contracted the coronavirus, was back on, giving the president another chance to calm growing alarm about the spread of the virus in America. (Hyosub Shin/Atlanta Journal-Constitution via AP)
Photo by: John Nacion/STAR MAX/IPx 2020 3/6/20 People wear masks to protect themselves from the Corona Virus in New York City.
Photo by: John Nacion/STAR MAX/IPx 2020 3/6/20 People wear masks to protect themselves from the Corona Virus in New York City. Shoppers have cleared store shelves of sanitizing products.
Vice President Mike Pence, left, arrives with Debi Birx, center, White House coronavirus response coordinator, and Robert Redfield, right, director of the CDC, Thursday, March 5, 2020, at Joint Base Lewis-McChord in Washington state for a visit with state officials. (AP Photo/Ted S. Warren)
Vice President Mike Pence greets Washington Gov. Jay Inslee, left, as Pence arrives, Thursday, March 5, 2020 at Joint Base Lewis-McChord in Washington state. Officials are avoiding handshakes due to the COVID-19 coronavirus. (AP Photo/Ted S. Warren)
HIDE CAPTION
SHOW CAPTION
of
SEE ALL
BACK TO SLIDE

"When people are hungry for information, they are vulnerable, because they've got their guard down."

CrowdStrike and other leading cybersecurity firms say the coronavirus has become the top new theme in schemes that use social engineering to induce recipients to open attachments or click on links that then open their computer files to attackers.

"This is dominating cybersecurity right now," said Jim Yacone, a former senior FBI official now at the SANS Institute, a cybersecurity research and education organization.

It's not just criminals — spy agencies appear to be using the technique, as well, experts say.

Security firm FireEye documented a China-based effort to extract information from Vietnamese government officials, as well as multiple campaigns targeting Ukrainian officials.

The U.S. Secret Service said in a statement warning the public: "Coronavirus is a prime opportunity for enterprising criminals because it plays on one of the basic human conditions … fear."

"Fear can cause normally scrupulous individuals to let their guard down and fall victim" to scams, the statement added.

The scams go well beyond the U.S. The security firm Fortinet found an email written in Italian, posing as a message from an Italian health agency, that induced users to click on an attachment that looked like a Microsoft Office document.

In fact, the user was downloading Trickbot malware.

Other hackers are sending emails with what purports to be a secret cure for the coronavirus. When recipients click on the link, they are asked to enter their credentials, according to the security firm Proofpoint, which also found fake WHO emails.

Authorities in the U.K. are also warning about coronavirus-related email scams.

The FBI, the Secret Service and security firms urge people to:

  • Avoid opening attachments and clicking on links within emails from senders you don't recognize.
  • Always independently verify that any requested information originates from a legitimate source.
  • Refuse to supply login credentials or financial data in response to an email.
  • Visit websites by inputting their domains manually.

"Making the public aware of how to protect themselves is a really important step in stopping this type of activity," Stapleton said.

Read Full Story