According to this email, which purports to be from cross platform messaging application WhatsApp, you have an incoming voice message. The message features a large ‘Listen’ button that supposedly allows you to hear your message.
However, the email is not from WhatsApp and the button does not lead to a voice message. Clicking the button actually opens a version of the notorious Canadian Pharmacy spam website that tries to sell you dodgy pharmaceutical products.
The spammers apparently believe that, by disguising their spam message as something completely unrelated to pharmaceutical products, it may effectively bypass spam filters as well as trick recipients into clicking the link and visiting the site. The spammers hope that at least a few recipients will actually stay on the site and purchase their suspect products. Since this is a tactic that has been used and reused over and over again, it obviously does work.
It is unwise and potentially dangerous to purchase medications from such pharmacy sites. Firstly, even if you do actually receive a product that you order, you have no way of knowing if it is the real thing or some potentially dangerous substitute. Secondly, because the medicine has not been properly prescribed by a doctor, it may interfere with other medications that you are taking or be unsuitable for you due to existing health conditions. Thirdly, these sites often use unsecure pages to process credit card transactions, which could certainly put your credit card details at risk. Fourthly, any group unscrupulous enough to use such deliberately deceptive spam tactics is not one you should trust with your credit card details or other personal information.
In some cases, the dodgy pharmacy websites may also harbour various types of malware that, if downloaded and installed, can steal information from the infected computer.
This spam campaign is also similar to an earlier and unrelated malware attack that also consisted of fake WhatsApp ‘New Voicemail’ messages. Clicking the ‘Play’ button in the emails opened malicious websites that tried to trick people into installing malware on their computers or smartphones.
Be wary of any email that claims that you have a voice message from WhatsApp and should click a button to hear it. Genuine WhatsApp voice messages will be delivered via the app itself, not via a separate email.
Last updated: November 16, 2015
First published: November 16, 2015
By Brett M. Christensen