A fraudulent mobile phone app disguised as a government-approved COVID-19 contact-tracing app has been targeting Canadians by attacking their data and holding it to ransom. 

A fake government of Canada website was set up to distribute the app on June 21, just days after Justin Trudeau announced that a nationwide contact-tracing phone app was in the works.

“Let’s work together to stay safe,” reads a note on the website, which also used official government of Canada logos. “The more Canadians who voluntarily download and use the app, the safer we’ll be, and the faster we can reopen the economy."

Downloading the bogus app activates a program that hijacks user’s private files. Hackers then demand payment for releasing the data.

ESET, the computer security firm that discovered the malware’s purpose, alerted the Canadian Centre for Cyber Security to the issue on Tuesday, June 23, according to The National Post.

Fake websites distributing the app have since been taken offline.

ESET researchers have also managed to create a tool that can rescue the data of hacking victims.

Meanwhile, the real government-approved contact-tracing app is not yet available for download. 

Announcing the software in a speech on June 18, Trudeau said: “People can be confident that this is an easy measure that they can have to continue to keep us all safe as we reopen. The app will be most effective when as many people as possible have it.”