On one level, attackers used tried-and-trusted tricks, sending email offers on behalf of online games to steal usernames and passwords, or fake notifications from major organisations which then link to a phishing resource. Multi-stage attacks on a new level are now becoming more common.
For example, messages invited recipients to take part in a survey and win money for doing so. Users followed the link, found themselves on a page with a customer satisfaction survey form and filled it in. After submitting the survey, they were redirected to a further form asking for their full credit card details in order to process the promised payment. Of course, the information was likely to be used to clean out accounts, rather than pay any cash.
The third quarter saw the volume of phishing emails increase very slightly and account for just 0.03 per cent of all mail traffic. The share of attacks on Facebook increased by five per cent which meant this social network climbed from 5th to 3rd in the rating of most popular phishing targets.
In previous spam reports it has been mentioned that phishers have lost interest in traditional banks, and this time, for the first time ever, there are just two banks featuring in the Top 10 in Q3 2011. This is because the theft of real money is more risky than stealing virtual money for phishers. Moreover, both approaches are almost equally lucrative.
Volume of spam dropping
Spam levels fell steadily throughout the quarter, except for a spike in the last week of September when the share reached 82.1 per cent. “Despite the decrease in the amount of spam in mail traffic its content has become more dangerous. The average percentage of spam with malicious attachments reached a record-breaking high of 5.3 per cent throughout Q3.
This spike, and a similar rise in adult content spam, could be the result of the summer holiday season and the ‘second wave’ of the global economic crisis. During the summer slowdown, and prompted by the uncertain financial climate, spammers look for scams that can keep them in business,” says Darya Gudkova, Head of Content Analysis and Research at Kaspersky Lab.
Think before opening attachments
Increased levels of spam with malicious attachments continued to threaten users in Q3 2011. The spammers deployed standard tricks to coax users into opening attachments, and used some new, more sophisticated methods. Among the latter, it was common to send emails with alarming subjects, an apparently encrypted text and a malicious attachment. The fraudsters were hoping that users would choose to open the attachment in the hope of making sense of the unintelligible email.
Overall, in Q3 2011 the average proportion of emails with malicious attachments increased by 1.17 per cent, reaching 5.03 per cent. As in the previous two quarters, Russian and US mail traffic carried a sizeable proportion of malicious attachments (9.8 per cent and 9.5 per cent respectively). Britain came third with 7.3 per cent of all detected malicious attachments, up 1.1 per cent on the previous quarter.
Spammer methods and tricks: hiding the evidence
In addition, spammers continue to actively use Google cloud services to bypass filtering. By adding a link that leads to a document in the cloud they can redirect users to spammer advertising sites.
2011’s major trend continued in Q3: more and more spam is coming from developing countries. India (+0.7 per cent), Indonesia (+4.7 per cent) and Brazil (+0.8 per cent) were the top three sources of spam. Q3 2011 saw considerable shifts in the distribution of spam by category. Education-related spam went down sharply (-39.9 per cent) compared to the previous quarter.
There were also declines in other categories of commissioned spam, such as Travel and Tourism (-4.3 per cent) and Other Goods and Services (-1.6 per cent). In their place, there was a growth in spam distributed via partner programs: Medications and Health-Related Goods and Services, and Adult Content spam.
Reading our newsletter every Monday will keep you up-to-date with security news.
Receive a daily digest of the latest security news.