The federal cyber security agency has issued an alert about a bogus COVID-19 vaccine registration SMS that “maliciously” gains access to a user’s Android phone, compromising their individual contact list.
At least five various variants of the harmful SMS have been reported.
“A fake SMS message has been circulating that falsely claims to deliver an app that allows users to register for the COVID-19 vaccine in India.”
The Indian Computer Emergency Response Team or (CERT-In) said in a public advisory issued on Saturday “It has been reported that a fake SMS message is in circulation that falsely claims to offer an app to let users register for COVID-19 vaccine in India.”
“The SMS carries a link that installs the malicious app on Android-based devices, which essentially spreads itself via SMS to victims’ contacts,”
The CERT-In is the government’s technology arm for combating cyberattacks and protecting India’s cyberspace from phishing, hacking, and other online threats.
CERT-In added that “app also gains unnecessary permissions that attackers could leverage to acquire user data such as contact list.”
Covid19.apk; Vaci__Regis.apk; MyVaccin_v2.apk; Cov-Regis.apk and Vccin-Apply.apk, are some of the identified variants of the malware.
It warned users to be wary of phishing scams that promise registration for a vaccine against the pandemic through fake domains, emails, and text messages.
CERT-In advised users to adjust their phone settings so that installation of apps from “untrusted sources” is disabled, and that users should go for secure browsing and use reputable anti-virus and Internet firewall tools as part of measures to prevent such malicious data breaches.
India is currently prescribing two COVID-19 vaccines to its people, Covishield and Covaxin, and the central government has provided nearly 18 crore vaccine doses to states and union territories, according to official data.