{"id":768871,"date":"2020-03-12T00:08:57","date_gmt":"2020-03-12T07:08:57","guid":{"rendered":"https:\/\/www.esri.com\/arcgis-blog\/?post_type=blog&p=768871"},"modified":"2022-02-16T10:45:36","modified_gmt":"2022-02-16T18:45:36","slug":"coronavirus-downloadable-malware-map-app-clarification","status":"publish","type":"blog","link":"https:\/\/www.esri.com\/arcgis-blog\/products\/arcgis-online\/administration\/coronavirus-downloadable-malware-map-app-clarification","title":{"rendered":"Coronavirus Downloadable Malware Map App Clarification"},"author":3911,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","format":"standard","meta":{"_acf_changed":false,"_searchwp_excluded":""},"categories":[37501,37131,28211],"tags":[24081,24071],"industry":[],"product":[36551,763582],"class_list":["post-768871","blog","type-blog","status-publish","format-standard","hentry","category-administration","category-constituent-engagement","category-health","tag-ssamymlgp","tag-security","product-arcgis-online","product-trust-arcgis"],"acf":{"short_description":"The browser accessible map dashboard providing information concerning the Coronavirus is safe to use.","flexible_content":[{"acf_fc_layout":"content","content":"

Updated March 20, 2020 – An increasing number of articles have been published on the Internet with unclear and sometimes misleading information concerning one of the primary dashboards for awareness concerning the spread of the Coronavirus.\u00a0 To be clear, the online map posted by Johns Hopkins University at https:\/\/coronavirus.jhu.edu\/map.html<\/a> does NOT contain any malware (and NEVER contained malware).\u00a0 This popular dashboard web application is hosted by Esri as part of our ArcGIS Online<\/a> offering.<\/p>\n

The confusion comes from an issue where a malicious person created a downloadable Windows-based application containing malware whose display is practically identical to the Johns Hopkins Coronavirus browser-based dashboard (see comparison figure below).\u00a0 Whomever posted the malicious downloadable app is attempting to take advantage of the strong public interest concerning the Coronavirus, but it requires the user to either download the app executable, or it could be distributed by email for the user to then install onto their local Windows system.<\/p>\n

The malicious app once downloaded and installed deploys malware called AZORult which is designed to steal credentials in the background (among other activities).\u00a0 To make the user think they are getting a Coronavirus map viewer, the app calls the URL of the Johns Hopkins dashboard and displays the results inside the application window.<\/p>\n

Bottom-line, you are fine browsing the Coronavirus dashboard on the web with your browser as no software needs to be downloaded.\u00a0 If you come across someone offering a Coronavirus dashboard where you need to download software to view it, don\u2019t use it!<\/p>\n

We have contacted other resources about this issue and will continue to monitor it closely.\u00a0 The malicious executable was removed from it’s initial download location hosted on a malicious site (not managed by Esri or Johns Hopkins), but it may appear again.\u00a0 If you receive an email containing a link to download such an item or come across the code for the malicious app please report it immediately to our incident response team through the ArcGIS Trust Center security concern page<\/a>.\u00a0 For general questions\/concerns feel free to reach out to our team SoftwareSecurity@esri.com<\/a>.<\/p>\n


\nSAFE URL’s utilized to support trusted Coronavirus map dashboards:<\/strong><\/p>\n