Tusk of evil: scammers used "mammoth pox" to cheat on the web
WHO conducted exercises in case of a new pandemic, in which the invented "mammoth smallpox" virus was used as a pathogen, the outbreak of which allegedly occurred after excavations. Against this background, cybersecurity experts have recorded a surge in fraudulent mailing activity about an "unknown virus" that Russians allegedly suffer from en masse, and in order to prevent the disease, it is necessary to find out the instructions on the link. About 7 thousand Russians received emails with fake links to "make an appointment for testing, vaccination or admission." For more information, see the Izvestia article.
A virus that doesn't exist
In March–April 2025, fraudsters began using several new schemes based on information spread in the media about an "unknown virus" that allegedly affected Russians en masse. According to the Information Protection Anti-Fraud Center, 6-7 thousand citizens received such letters and messages during this period.
About 30% of the recipients live in Moscow and the region, and another 13% live in St. Petersburg and the Leningrad Region. Such attacks have also been recorded in other regions of the Central and Northwestern Federal Districts, in the Volga region, in the Southern Federal District, and in the Urals. In 60% of cases, the attackers sent messages on behalf of non-existent medical and pharmaceutical companies.
— For example, in Moscow, citizens received letters from the Department of Combating Mass Diseases, which does not exist. In other cases, existing local and regional authorities related in one way or another to healthcare and the sanitary and epidemiological situation were used," Pavel Kovalenko, director of the Informzashita Anti-Fraud Center, told Izvestia.
In April, WHO conducted exercises in case of a new pandemic and simulated an outbreak of "mammoth smallpox", a fictional virus. These messages were immediately picked up by scammers.
— Through social networks and messengers, they can spread false messages about "mammoth smallpox," including appeals for donations for the treatment of patients, the development of vaccines, or the sale of "miracle medicine." The money is transferred to fake accounts," Igor Bederov, head of the Information and analytical research department at T. Hunter, told Izvestia.
The issue of sanitation has been particularly sensitive since the coronavirus pandemic, which is why attackers are actively using it to deceive citizens. Criminals use different ways to explain the origin of the new disease, among the most common is the SARS—CoV-2 strain, brought by tourists from Southeast Asian countries. They apply on behalf of medical organizations, sanitary services, and public health authorities, Informzashchita added.
— There are several basic schemes of deception with an "unknown virus". Most often, the victim receives an email or a messenger message urging them to urgently be tested for the presence of this pathogen. The service is offered for free and a recording link is sent. After entering the data, fraudsters steal personal data, with which they can, for example, gain access to other services, including banking applications," Pavel Kovalenko said.
In the cases studied by experts, the amount ranged from 4 to 10 thousand rubles.
Another option is fundraising. Criminals offer a person to make a donation in favor of scientists involved in the development of a vaccine against a new virus, to provide funds for the purchase of medical supplies in hospitals, or to help citizens who cannot afford to pay for treatment for the "unknown virus."
How else are citizens being deceived
Attackers often use the fear of Russians in order to motivate the victim to commit rash acts. The attackers' strategy is based on psychological pressure — disturbing emails with such topics force the victim to act hastily and thoughtlessly, which eventually leads to the loss of accounts on various portals, says Alexander Vurasko, Director of Development at the Solar AURA External Digital Threat Monitoring Center, Solar Group.
— If we talk about an "unknown virus", then citizens will be alarmed, and the percentage of those who click on the link to "make an appointment for vaccination or admission" will be considerable. Especially in conditions of seasonal morbidity, when there is a real surge in viral infections. For such attacks, attackers most often use instant messengers, as email is not as effective for attacking users outside of companies and organizations. Then there may be some kind of "website" or simple requests to provide information from SMS," added Alexey Gorelkin, Phishman CEO and information security expert.
Scammers often use current news, fears, or high-profile events (such as WHO exercises, political events, and disease outbreaks) to create convincing fake scenarios. The attackers use phishing emails or threatening messages, fake websites and malware distribution, Igor Bederov recalled.
— Scammers carefully think over the design of emails and websites. They use logos of government agencies and refer to real events to increase trust. During calls to their victims, they introduce themselves as doctors or employees of epidemiological services. They often claim that a person has been in contact with a virus carrier and must pay for an emergency diagnosis. They are asking to install a "secure application" to track quarantine, which actually gives access to banking applications on the phone, he said.
Informzashchita experts remind that official bodies and organizations do not ask to transfer money to phone numbers, do not request SMS codes and do not send links. Previously, scammers used, in particular, the myth of freezing accounts and deposits, to prevent which it was necessary to click on the link. Another scheme was reported by Izvestia in April, it concerns self-locking on loans, the legend of which has become particularly effective.
Переведено сервисом «Яндекс Переводчик»
