Endpoint Protection

Symantec has been observing a novel image spam campaign for a while now. So, what’s out of the ordinary in this spam attack? Well, these image spam messages do not have any content—not a single word, not even in the subject line! These messages only display images that promote medicinal pills or cheap software. You may find some exceptions though, such as in Russian dating spam, where message content and images go hand in hand.

The subject lines in the image spam attacks that have consistently dominated the last 30 days (in descending order of the number of messages) are as follows:

Meds Image Spam  

1.    Blank Subject lines – 51  % of overall image spam messages

Cheap Software Spam

2.    Fw: - 18 %
3.    Fwd:  11 %
(A combined 29 % of overall image spam messages.)

In the case of other headers such as Message-ID or Content-Type, spammers have made every attempt to randomize them in order to raise the difficulty level for anti-spam players.

Example images of (wavy) meds image spam:

 



 

Example image of cheap software spam (Note: domain name and part of image removed):

Example image of Russian dating spam:

 


Spammers are obviously trying these tactics in order to escape anti-spam filters. At present, Symantec is constantly monitoring these attacks and blocking them effectively with its anti-spam solutions.