Hackers made their own coronavirus map to spread malware, feds warn
Johns Hopkins University created a real-time map tracking the global spread of coronavirus.
Now hackers are ripping it off.
“A malicious website pretending to be the live map for Coronavirus COVID-19 Global Cases by Johns Hopkins University is circulating on the internet,” the North Carolina National Guard said in a tweet Thursday.
The original map — which launched Jan. 22 as COVID-19 cases began to balloon in China — was created by the Center for Systems Science and Engineering at Johns Hopkins to provide up-to-date information on the location and number of confirmed cases, deaths and recoveries, according to the university.
Researchers, public health officials and journalists have used it to keep track of the spread.
Coronavirus cases
Click or touch the map to see Coronavirus cases. The data for the map is maintained by the Center for Systems Science and Engineering at the Johns Hopkins University and automated by the Esri Living Atlas team. Data sources are WHO, US CDC, China NHC, ECDC, and DXY. Data is updated every hour. Note: Some cases from the Diamond Princess cruise ship are grouped in Japan on this map and do not show up in the US.
But according to the National Guard, a copycat version is infecting “unwitting internet users” with a program designed to steal sensitive data such as passwords, usernames and credit card information.
They warned the fake map is likely being spread through email attachments, advertisements, “social engineering” and online searches for the real thing.
CYBER SECURITY ALERT: A malicious website pretending to be the live map for Coronavirus COVID-19 Global Cases by Johns Hopkins University is circulating on the internet, visiting the website infects the user with the AZORult trojan. The legitimate link is: https://t.co/5asuZ1keJG pic.twitter.com/Ye7u8or62r
— NC National Guard (@NCNationalGuard) March 12, 2020
Cybersecurity researcher Shai Alfasi, who analyzed the malware for Reason Labs, found it infects users with malicious software known as AZORult.
The so-called information stealer was first discovered in 2016 and frequently shows up on “underground forums” in Russia, he said. It can reportedly scrape users’ browsing history, cookies, passwords and cryptocurrency, among other things, and downloads more malware onto machines it’s able to breach.
Some versions of AZORult also enable hackers to create a secret administrator account to remotely access a computer, Alfasi said.
“As the coronavirus continues to spread and more apps and technologies are developed to monitor it, we will likely be seeing an increase in corona malware and corona malware variants well into the foreseeable future,” he said.
