Fake COVID Vaccine Certificates And Real Vaccines Are For Sale on Dark Web
Now that vaccines for the coronavirus are available, some people are eager to prove they have received the shots even if they haven't. These folks are willing to pay unseen grifters to help them dupe local officials, cruise lines, the airline industry, potential employers and other doubters, according to a study set for release Tuesday.
There are three dozen vendors on the Darknet, which is not visible to search engines, that are selling fake certificates for up to $200 each, according to Check Point Research, a division of Check Point Software Technologies.
The purpose of the phony documentation is for buyers to allegedly use it to prove to employers, airline employees, cruise line personnel, government officials and other interested parties that a vaccine has been administered while, in fact, it hasn't.
"Each vendor is capable of pumping out scores of these," Check Point spokesperson Ekram Ahmed said. "The buyers are likely distributors more than individuals, and more vendors are springing up weekly."
There are also do-it-yourself (DIY) options on the Darknet that offer user-friendly interfaces for buyers who pay as little as $25, then provide personal information so that a phony document can be delivered via email within 30 minutes.
"We do negative COVID tests for travelers abroad and for getting a job," reads one ad on the Darknet. "Everything is done within 24 hours, without big collaterals."
The vendor who published this ad also promise "high quality" and a special offer: "Buy 2 negative tests and get the 3rd for free!"
Those who are selling fake documentation are oftentimes hackers who "are more interested in your information and identity for exploitation" than they are in the initial payment, said Oded Vanunu, the head of products vulnerabilities research at Check Point.
"Cyber criminals are looking to capitalize on the public's interest to both get the vaccine or avoid the vaccine," Vanunu said.
Thus, in addition to the fake paperwork, Check Point has identified 1,200 ads for black-market sellers of the vaccines themselves—representing a more than 300 percent surge in three months. They are also sold via the Darknet, oftentimes by the same vendors who sell faux documentation.
The vaccines are advertised as being made by legitimate pharmaceutical companies AstraZeneca and Johnson & Johnson, as well as Russian Sputnik and Chinese SINOPHARM, and they can costs from $500-$600 per dose.
Check Point posed as a customer in Israel to purchase a vaccine from a vendor in China and paid for the item in Bitcoin, as demanded by the seller. A week later, Check Point still had not received the vaccine.
"We may still get it, and if we do we'll update our research and get the authorities involved, as well as the brands of the vaccine." said Ahmed. "It literally could turn out to be water or, unequivocally, it could be the most dangeorous thing you could inject."
A separate study two weeks ago from cybersecurity firm Kaspersky found that the Darknet vendors had sold from 100-500 vaccinations apiece for as little as $250 and as much as $1,000 per dose, while 30 percent may be legitimate vaccines even when sold illegally online.
"There are pictures of packaging and medical certificates. It looks like some of these people do have inside access to medical institutions," according to a Kaspersky researcher.
"Medical institutions, pharmacies, and hospitals around the world often end the day with leftover vaccine doses," says the Kaspersky study. "It's not inconceivable that someone working at these facilities could pocket the extra doses and connect with dark web intermediaries to sell them."
