Warning about ‘Dance of the Hillary’ video and Pakistani cyberattack is a hoax

A rumor shared online in the summer of 2025 warned of a cyberattack threat originating from Pakistan and circulating by email and text message, and that the allegedly dangerous messages mentioned a “Dance of the Hillary” video and “tasksche.exe” file attachment. The warning made the rounds during the fallout following a deadly shooting at a resort in India in April that had renewed the country’s tensions with Pakistan in subsequent weeks.

Snopes received messages from readers asking about this rumor. For example, one person asked, “Is this real: ‘Dance of the Hillary’?” Another reader sent, “I received a message not to open a text ‘Dance of the Hillary’ because it is a cyberattack from Pakistan. Is this true?”

On July 1, one Facebook user posted (archived) a widely-shared bit of copied-and-pasted text beginning with the words “heads up” and a claim about BBC Radio:

Forwarded but sourced. Although some information is contradictory, it’s better to be safe than sorry. Protect yourself recommendations came from Google search AI.

Heads up: Please inform all contacts from your list not to open a video called the “Dance of the Hillary”. It is a cyber attack from Pakistan. Beware it is very dangerous. They announced it today on BBC radio. Fwd this msg to as many as you can!”

“To protect yourself:

Be cautious with unknown links and attachments, especially those containing videos or executables with names like “Dance of the Hillary” or “tasksche.exe”.

Verify senders and do not click on suspicious messages.

Keep your software updated and use reputable antivirus software.”

Users shared the above copypasta on Bluesky (archived), Facebook (archived), Instagram, LinkedIn (archived), Threads (archived), TikTok (archived), Truth Social (archived), X (archived) and YouTube (archived).

However, the claim of a threat involving a “Dance of the Hillary” video and tasksche.exe file was nothing more than a long-running online hoax. An unknown person fabricated the alleged threat over a decade prior to July 2025. In other words, users’ many warning messages advised recipients of a completely nonexistent threat. A search of the BBC’s website found no evidence that it ever reported on any such news online or on its radio network.

Indian state police reported hoax as real

Even though the “Dance of the Hillary” virus warning was a known hoax, the India-based CNBC-TV18 reported that, on May 11, the official police Facebook (archived), Instagram (archived) and X (archived) accounts for the Indian state of Punjab shared warnings about the purported threat. The posts announced in a video, “Pakistan-based hackers have launched a new digital attack — not through missiles, but through your phone. A malicious virus called ‘Dance of the Hillary’ is spreading via WhatsApp, Telegram & Email, targeting Indian users.”

Four days later, a manager of the accounts also posted a general notice (archived) advising citizens to watch out for “fake news” — but made no mention of the fabricated virus warning.

Transcript of WhatsApp warning messages

An X user’s post (archived) featured screenshots of the WhatsApp messages circulating in May 2025. One message read: 

Please inform all contacts from your list not to open a video called the ‘Dance of the Hillary.’ It is a virus that formats your mobile. Beware it is very dangerous. They announced it today on BBC radio. Fwd this msg to as many as you can!

A second message displayed in the post mentioned the tasksche.exe file and ransomware attacks. The FBI defines ransomware attacks as “a type of malicious software — or malware — that prevents you from accessing your computer files, systems or networks, and demands you pay a ransom for their return”:

Massive Ransomeware attack…Total 74 countries affected…Please do not open any email which has the attachments with “tasksche.exe” file. Please send this important message to all your computer users

Except africa all countries IT companies r hacked

Don’t do any online transactions today

Also avoid using ATM unless very urgent…..

Don’t open any shopping carts today

Stay tunned with latest news for updates…Also keep antivirus ON and do not operate bank n shopin sites for pay utility through mobile hold on for today before doin nythin…..

The .exe extension for tasksche.exe referenced the executable file format used by the Microsoft Windows operating system.

Warning allegedly named for Hillary Clinton

On April 7, 2015, Snopes first reported on the “Dance of the Hillary” virus warning hoax, then also known as “Dance of the Pope.” Five days later, former U.S. Secretary of State Hillary Rodham Clinton formally announced her intention to run for the Democratic Party’s presidential nomination for the 2016 election. The blog That’s Nonsense, also reporting the warning as a hoax, speculated that the timing of the alleged threat “likely” meant the “Hillary” in “Dance of the Hillary” referenced Clinton, as opposed to a different person.

The Sri Lankan arm of the Fact Crescendo fact-checking website previously reported on this matter in May 2025, calling the viral warning a “recycled hoax.”

For further reading, in 2023, Snopes twice reported on a similar alleged threat that circulated on WhatsApp, in which users warned of the dangers of opening another nonexistent file named “Seismic Waves Card.” With that hoax, users vaguely claimed the news of the threat appeared “on TV,” somewhat similar to how the “Dance of the Hillary” hoax misleadingly mentioned BBC Radio.

Snopes’ archives contributed to this report.

Sources