Beware: A Malicious COVID-19 Vaccine SMS Message Is in Circulation

A fake SMS message is in circulation that falsely claims to offer an app to let users register for COVID-19 vaccine in India. However, instead of providing a legitimate way to register for the vaccination, the app is aimed at propagating malware via SMS messages once it is installed on a mobile device. The malicious app was initially named COVID-19, though it later received an update that renamed it as Vaccine Register. Attackers may be able to convince users to install the app as a large number of people faced issues while registering for the COVID-19 vaccine through the official CoWIN portal.

Cybersecurity firm ESET’s malware researcher Lukas Stefanko has tweeted about the SMS message that asks users to download the app to register for the COVID-19 vaccination. The message is targeted at Indian users and is designed in a way that impersonates ‘COVID-19 vaccine free registration’, according to the researcher.

The researcher said that the SMS message, however, carries a link that installs a worm app, which essentially spreads itself via SMS to victims’ contacts with the link to download the malware. The app also gains unnecessary permissions that attackers could leverage to acquire user data.

Although the app was initially called COVID-19, it was renamed to Vaccine Register and received a light mode to reach even further devices over time. It is also found to have support for dual-SIM connectivity. This will allow the malware to propagate using the first available operator available on the device.

Users are highly recommended to avoid to any SMS messages that contain links asking them to download apps. It is also important to note that registrations for COVID-19 vaccines are currently taking place only through the CoWIN portal as well as the Aarogya Setu and Umang apps.

However, there are third-party sites through which you can receive notifications when a slot for the jab is available. The government has also provided the option to find your nearby COVID-19 vaccination centre using the MyGov Corona Helpdesk chatbot.

The government expanded the COVID-19 vaccine rollout in the country last week by starting registrations from people between 18–44 years. The vaccine registrations were earlier open for the people of 45 years and above age.