Coronavirus Android Worm

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Poses as an app that can offer a "corona safety mask" but phone's address book and sends sms to contacts, spreading its own download link.

Threat Analysis

Coronavirus Android Worm is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://dissectingmalwa.re/jamba-superdeal-helo-sir-you-want-to-buy-mask-corona-safety-mask-sms-scam.html

→https://www.zscaler.com/blogs/research/new-android-app-offers-coronavirus-safety-mask-delivers-sms-trojan

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

apk.corona_wormCoronavirus Android Worm

External Intelligence

Malpedia: apk.corona_worm

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Coronavirus Android Worm