Spammers exploiting social engineering to spread malware: Commtouch

Share this article:

Spammers are increasingly using social-engineering techniques to lure e-mail recipients to open e-mail infected with malware, according to a new study by e-mail security company Commtouch.

The study, "Q1 2007: Malware Outbreak Trends," describes how malware writers use speed, variation and social-engineering techniques to mass distribute malicious software over the Internet. They have adopted the methods on a large scale in hopes of getting e-mailers to open infected messages and attachments.

"Users have had it drilled into them that they should not open attachments they are not expecting or from people they do not know, but sometimes the temptation is just too great," said Rebecca Steinberg Herson, senior director of marketing at Commtouch, Sunnyvale, CA. "Lots of people want to see an interesting video clip or open a greeting card, so if the subject line makes sense to them and the sender's name sounds familiar enough, users are clicking on the attachment and getting infected."

The Commtouch report said the Storm/Nuwar e-mail-virus outbreak in mid-January used tabloid-like headlines - including "230 dead as storm batters Europe," "First nuclear act of terrorism!" and "a bouquet of love" - in their e-mail subject lines to persuade readers to click.

In February, the Tibs/Zhelatin e-mail-borne malware was disguised as a Valentine's Day greeting. It combined a subject-line holiday greeting - such as "5 reasons I love you" and "A song to you" - with file the names "flashpostcard.exe" and "greetingcard.exe."

In addition, the Nurech malware tried to fool e-mail recipients by adding recognizable file signatures such as ".doc," ".jpg" and ".pdf" before the ".exe" extension.

"The distribution speed of malware has increased significantly over the past year or so, since it is being sent out via zombies - computers that have been taken over by a bot and used to send out spam and malware - without the user's knowledge," Ms. Steinberg Herson said.

"Because the distributors have virtually unlimited sending power from PCs all over the world," she said, "they can afford to send vast amounts of malicious e-mail simultaneously from multiple locations."

Share this article:

Sign up to our newsletters

Follow us on Twitter @dmnews

Latest Jobs:

More in Email Marketing

Forrester: Keep Your Eye on the Email

Forrester: Keep Your Eye on the Email

Merging email with other channels is all well and good, but a Forrester Wave analysis holds that the email channel itself could stand improvement.

Email Opens Have Increased While Clicks Remain Static

Email Opens Have Increased While Clicks Remain Static

Open rates rose to 32.9% in Q1 2014, but clicks haven't changed for the past couple of years, a study says. But why?

Is Reliance on Email Stifling Lead Nurturing?

Is Reliance on Email Stifling Lead Nurturing?

Pressure to drive revenue has some B2B marketers looking to take a more multichannel approach to lead nurturing.