The Spam Report, August 2008

Spam messages announcing World War 3 has commenced lure curious web users

Taking advantage of the latest events and trends around the world, spammers resorted to using the heated US political campaign and even the Beijing Olympics as themes to lure unsuspecting victims.

This seems to have contributed to spam levels averaging at 78% of all messages last month, up
from representing 66% of all messages in July last year. The increase has been reported in Symantec's August 2008 State of Spam report that identifies internet, product, finance and health related attacks as the biggest spam categories, contributing to 22%, 21%, 20% and 16% respectively of the total number of spam messages.

Current affairs dominated spammer techniques, targeting topics such as the US presidential campaign and the Olympic Games in China. Using emails with sensational subject headings like ‘Beijing Olympics cancelled' and ‘McCain supports idea that Obama is Muslim', users are enticed to open messages. A link included in the email that promises to offer more information, instead hosts malware. This is most often designed to infect other computers with viruses and trojans, rather than simply promoting a spam product.

That's not all; spammers are now misleading web users with messages containing a Trojan virus, claiming that World War 3 has begun after a US invasion of Iran. Detected as Trojan.Peacomm by Symantec AV, the email reads: "Just now US Army's Delta Force and US Air Force have invaded Iran. Approximately 20000 soldiers crossed the border into Iran and broke down the
Iran's Army resistance. The video..." The email also contains what appears to be a video, showing a bomb explosion, which links to the Trojan when clicked by curious recipients.

Riding the recent health trend wave, superfoods that promote weight loss and offer other health benefits are being promoted by spammers by illegally using logos of prominent news broadcasters. It's indicated that products can be tried without any cost. However, a quick look at the small print, hidden away on a separate page that the promoters do not require the recipient to open shows it's far from free - by signing up for the offer the recipient agrees to have $74.95 billed monthly to their account. The message manages to pass through filters because the spammer uses several different domains, embeds hundreds of words hidden in the HTML tags, and changes the subject and sender line before initiating each attack.

In another unsettling spam alert, phishing emails targeting Microsoft POP3 user data have also been observed. The email claims that recipients have a POP3 setting problem and need to click on the URL in the email to confirm account data. Email sender information is displayed as
"Microsoft" - service@securitycenter.com - with a subject line reading: Message from Microsoft or Subject: Microsoft Outlook Verification #. The URL in the message leads the recipient to a hacked website instead of the Microsoft website, requesting personal data from the user.

It's advised that all web users install and enable spam filters in order to avoid adding to the growing number of spam attack victims worldwide.