IT Jobs
Spammers turn to Excel attachments
Pump-and-dump scams take on a new form.
By Matthew Broersma | Techworld
Published: 15:38 GMT, 25 July 07
Excel files are the latest format to be taken over by spammers for use in pump-and-dump stock scams.
Commtouch, which makes anti-spam and email security products, said it first began detecting Excel spreadsheet-based spam on 21 July. The spam promotes stocks in attachments with names such as "invoice 20202.xls," "stock information-3572.xls" and "requested report.xls."
Commtouch chief technology officer Amir Lev said the shift is likely to indicate that other formats are in line to be co-opted into this particular form of spam. "We expect other file formats to follow suit; think of the spam potential in Powerpoint files, or Word documents," he said in a statement.
Pump-and-dump scams illicitly promote shares in particular companies, raising the stock price so that the scammers can then sell their own shares and reap the profits.
Commtouch said the use of such attachments is designed to get around spam filters that analyse messages based on content. The technique has previously been used to spread viruses.
The latest emails are being sent by zombie "bots," Commtouch said.
Two weeks ago Commtouch said it detected a massive surge in PDF-based spam, with 10 to 15 percent of all spam in one day arriving with PDF attachments.
PDF spam has taken over in popularity from image spam in recent weeks.
As spam continues to slip past barriers, a recent survey found most people are not happy with their anti-spam products. From McAfee and Symantec to Apple and Microsoft, most anti-spam vendors are failing to fully satisfy customers, according to the survey by Brockmann & Company.
The best-performing technology by a large margin is made by challenge-response vendors like Sendio and SpamArrest, which challenge the identity of first-time senders, the report states.
Add your commentComments
Emmanuel Cohen-Laroque | Published: 06:43 GMT, 26 July 2007
Indeed, spammers are using Excel and Word documents. At Intomic Ltd (www.intomic.com), we have identified these new forms of attacks since July 14th and have already deployed ah-hoc filters.