Even though we hope that this is an unnecessary warning, we do want to put it out there. As soon as there was talk about a vaccine being available against the COVID-19 virus there were vendors on the Dark Web offering Russian and Chinese COVID-19 vaccines for sale. Now that the UK has started its inoculation program, we’ve see the first offers of “tested COVID-19 vaccines” appearing online.

Granted, it didn’t take the genius of Shakespeare to come up with that plot.

In a single day, 645 COVID-19 listings were discovered across 12 dark web markets, a study from the Australian National University found.

One example

Below is a screenshot of a Dark Web vendor selling a “Corona virus vaccine” (sic) developed in Israel. The vendor states it will be ready in a few days, most likely to extend the period before they start getting complaints that could drive other potential buyers away. As you can see, they envisioned a vaccine far before anyone thought it was even feasible.

Will you receive a real COVID-19 vaccine?

As I see it, there are a few possible scenarios that might play out should you decide to order a “tested COVID-19 vaccine” on the dark web:

You will receive nothing at all. You should be happy, all you lost is some money.
Possibly a shipment will be sent to your address, but it will not be a real vaccine. With any luck it will be a harmless placebo.
The shipment contains a vaccine, but it isn’t the coveted coronavirus vaccine. You have no idea what it really is. Let’s hope you are not allergic to it.
In the very unlikely case you receive an actual COVID-19 vaccine, there’s a good chance that it’s not an FDA approved vaccine. The only approved vaccine to date has to be stored and transported at -94°F (-70’C). Will our Dark Web vendor use the cold chain distribution method?

Seriously, there is a huge demand for the real vaccines, and worldwide logistics experts are working out plans to get these vaccines to those that need them the most, in the safest and fastest way.

Warnings

At Malwarebytes Labs we have warned in the past against buying illegal drugs on the internet. You can heed the same warnings for medicines.

A researcher at CloudSEK contacted one of these vendors and requested proof of what they were selling. In response they sent a stock image. You can read their back and forth here.

A warning was issued after ‘Pfizer COVID-19 vaccine’ was found for sale on the Dark Web – at around £1,000 a dose. As we pointed out earlier, given the controlled temperature required for this vaccine’s storage and transport, these are highly unlikely claims.

Europol warned in April about the potential harm of offline and online scams offering alleged versions of the COVID-19 vaccine. Then, in October, it discovered a Mexico-based operation pushing fake influenza vaccines on the cybercrime underground. It’s likely that the same actors will see another opportunity with the rollout of a COVID-19 vaccine, Europol said.

It’s a golden opportunity for cybercriminals, who can use fake vaccine offers as bait. Europol said high demand for the vaccine and potential shortages will likely drive consumers online looking for alternatives.

“Some dark web markets feature advertisements for fake COVID-19 vaccines. The number of offers is limited at this stage but will likely increase once a legitimate vaccine becomes available. Criminals advertise their fake vaccines using the brands of genuine pharmaceutical companies that are already in the final stages of testing.”

The Food and Drug Administration said the first Covid-19 vaccine being considered for US distribution “met the prescribed success criteria” in a clinical study, paving the way for the agency to green-light distribution as early as this weekend. It’s likely this will increase the number of fraudulent offers.

Stolen vaccine data

Documents related to the development of one COVID-19 vaccine have been unlawfully accessed in a cyberattack on the European Medicines Agency (EMA), which is the EU version of the Food and Drug Administration (FDA).

You can expect scammers to use this information to give extra credibility to their lures. For example, by claiming they have fabricated a COVID-19 vaccine using the information that was in the stolen documents. Again, this concerns the vaccine that needs to be handled under cold chain conditions, so any vaccine based on those specifications will require the same treatment.

Don’t let panic control your actions

While we understand the reasons why some people may want to get the vaccine before their government decides it’s their turn, panic – and greed – are always bad advisors. They are the exact basic instincts that scammers thrive on.

Don’t add an unfortunate accident with an unlikely vaccine sold by a shady Dark Web vendor to the list of things that went wrong in 2020.

Stay safe, everyone!

The post Buying COVID-19 vaccines from the Dark Web? No thanks! appeared first on Malwarebytes Labs.