Spammers arm junk mail with multiple threats

Opportunistic spammers are increasingly posting additional threats, such as links to malware, within the body of their unsolicited email messages, according to new findings by internet security company Marshal. The practice, which Marshal has dubbed “piggyback spam”, was only prevalent in around two to three percent of spam until the last seven days, when it shot up to around 15 percent of total spam.

Marshal has provided a few working examples. In the first, an image-based spam message flogging pharmaceuticals also included a separate offer pertaining to a new software application which tracks the location of any mobile-phone user.

The link to a free download of this software points to a malicious file that could hand control of the computer over to spammers.

Spammers, says Bradley Anstis, director of product management for Marshal, are clumsily attempting to be more efficient by arming a single email with a wider array of threats.

“They are not just sending you an unsolicited message but also expanding the botnet so that they can start sending more spam from your machine,” he said.

A second example is a spam email which includes an additional message from somebody claiming to be a lonely and bored 25-year-old woman, offering pictures of herself via a web link. The web link is actually an executable malicious file.

Anstis said there are still plenty of email users that would be double-duped — firstly by opening an unsolicited message, and secondly by clicking on an unrelated link within it.

“We can’t assume that all users realise when a message is spam,” he said. “People are still falling for these messages.”

Paul Ducklin, Asia-Pacific head of technology for antivirus vendor Sophos, said the attacker’s desperation might actually work against them.

“There is a silver lining here, because emails with multiple threats can be blocked if even one of these threats is recognised,” he says. “Sometimes, when cybercriminals try too hard, we paradoxically win more easily because there is more dangerous behaviour to spot.”