In April and May 2021, readers asked Snopes to investigate a viral message, spread primarily through WhatsApp, claiming that an image file with the name "Mexico did it" was about to be shared online and was a vehicle for malware that would quickly wreak havoc on users' cellphones.
The warning, which was also widely posted on Facebook, typically contained the following text:
They are going to publish an image that shows how Covid 19 is cured in Mexico and it is called "Mexico did it." Do not open it because it enters your phone in 5 seconds and it cannot be stopped in any way. It's a virus. Pass it on to your family and friends. Now they also said it on CNN and BBC.
As an illustration of the message's popularity on Facebook, the following screenshot shows just a selection of posts from late April and early May 2021:
The viral warning was bogus and followed the same pattern as a similar viral message that began to spread in the summer of 2020. We are issuing a rating of "False."
We found no evidence to support the claim that such a virus even existed. Furthermore, as of May 3, 2021, neither CNN nor BBC had published or broadcast any reports that warned the public about such an imminent malware attack.
In July 2020, Snopes debunked another viral warning that bore significant similarities with the "Mexico did it" message in 2021. On that occasion, the bogus message read:
They are going to start circulating a video on WhatsApp that shows how the Covid19 curve is flattening in Argentina. The file is called "Argentina is doing it." Do not open it or see it, it hacks your phone in 10 seconds and it cannot be stopped in any way. Pass the information on to your family and friends. Now they also said it on the CNN.
The two messages were almost identical. The 2021 version changed the country from Argentina to Mexico, substituted an image file for a video file as the putative vehicle for the malware, claimed the virus would take effect in only five seconds as opposed to 10, and falsely claimed that the BBC, as well as CNN, had reported on the supposed malware attack.