On 16 October, eight near-identical emails landed in the spam folder of one of our Gmail addresses. They pose as a “CBS News” report: Clint Eastwood, 94, supposedly got his breath back thanks to a $1 “lung reset”, endorsed by doctors Sanjay Gupta and Mehmet Oz. It’s a health scam, and the code of the messages confirms it. Here is what they say, what gives them away and what to do.
What do these “CBS News” emails say?
Six messages are about chronic obstructive pulmonary disease (COPD); two others reuse the same pattern with Dr. Oz. The subject lines are written to shock, for example “Throw out your oxygen tank: The $1 lung reset outperforming steroids”. The body imitates a news article: a “CBS NEWS” logo, a quote from the actor, photos of doctors, then a button leading to a product, “Breathizen”, whose name appears only once.
They were sent from eight different domains, unrelated to each other and to the TV network:
An impossible medical promise
The message says it outright: you could do without your oxygen and your treatments. That is false, and dangerous. According to the UK’s National Health Service, COPD cannot be cured and the damage cannot be reversed; treatment can only slow its progress and ease the symptoms, according to NHS page on COPD. A patient who stopped their inhaler or oxygen therapy because of an email risks a real worsening of their condition.
Another inconsistency: Clint Eastwood was born in 1930. He is 96 today, not 94. A newsroom wouldn’t make that mistake.
Celebrities and a news outlet named without their consent
- “CBS NEWS” is HTML text. In the code, the logo is just a styled heading, not an official image, and no link leads to cbsnews.com.
- Dr. Sanjay Gupta is known as CNN’s chief medical correspondent, a rival network. He has no reason to sign a report like this.
- Dr. Mehmet Oz is one of the figures most often hijacked by fraudulent ads: many fake articles use his name and face to sell supplements.
- The Clint Eastwood quote is invented. These schemes borrow a celebrity, sometimes through video editing (deepfakes), to build trust.
Red flags in the email’s code
We opened the source code of two of the eight messages (“Show original” in Gmail). It shows several flaws a real news outlet wouldn’t let through:
- Links to storage.googleapis.com. The buttons lead to a public Google storage space used here as a redirector: the link looks safe, but it belongs to no news outlet.
- A template left as is. The
{privacy_link}placeholder was never replaced: the sending tool didn’t fill in its own template. - A broken image where a photo should be.
- An unsubscribe link pointing to the same domain whichever sender it comes from.
- Hidden text at the start of the message, meant to fill the inbox preview.
What the headers reveal
- SPF failing or doubtful: the sending domains don’t authorise the servers that sent the messages.
- Google Cloud IP addresses: anyone can rent this kind of server, including to send spam.
- Made-up recipients: the “To” field holds other addresses than ours, a sign of mass mailing.
- Eight unrelated domains, one circuit: the same unsubscribe domain and the same “/lis” path appear everywhere.
Two limits to keep in mind. We examined the raw code of only two of the eight emails, and we did not visit the destination pages, to be safe. The aim of the operation, selling a product or earning an affiliate commission, is therefore an inference from the usual pattern of such campaigns, not an observed fact.
What to do if you receive this kind of email
- Don’t click any link or button, including the unsubscribe link: it confirms that your address is active.
- Never stop a treatment because of an email or an ad. Talk to your doctor or pharmacist.
- Report the message as spam. In the US you can also report it to the FTC at reportfraud.ftc.gov; elsewhere, use your national consumer authority.
- If you ordered, dispute the payment with your bank and cancel any related subscription. “$1” offers often hide a subscription.
Webmaster: why these emails reach an address that doesn’t exist
If your domain has a catch-all mailbox, which accepts any message sent to any address, it also receives spam sent to guessed or generated addresses. If you don’t need it, switch it off and create only the addresses you use.
One more scam wearing familiar faces
This campaign follows the logic of other scams described on safecode.fr, such as the fake €195 tax refund or the fake cloud storage email: a credible disguise, a message that plays on emotion, and a click as the only goal. Here, the emotion is health.
Frequently asked questions about the fake CBS News emails
No. The quote is invented and COPD is a chronic disease that cannot be cured. No serious report presents a cure like this.
No. They are sent from eight domains unrelated to the network, through Google Cloud servers, and the “CBS NEWS” logo is just text in the code.
There is no evidence they agreed. Their names and faces are regularly hijacked by fraudulent ads.
No. Never change a treatment without your doctor’s advice: stopping COPD treatment can make the disease worse.
Close the page without entering anything. If you paid, contact your bank to dispute the payment, cancel any subscription and report the offer to your consumer authority.
Leave a Reply