Malware spam is back after a one-month hiatus! The attack has returned to the forefront of the spam threat landscape in the form of .zip and .html attachments, as discussed in the September 2010 State of Spam & Phishing report. Malware spam more than tripled in volume, and .zip attachment spam saw a four-fold increase month-over-month. As such, we reviewed what this attachment spam contained and discussed how those threats pose a serious risk to users. Overall, spam made up 92.51 % of all messages in August, compared with 91.89 % in July.

For this and much more, click here to download the September 2010 State of Spam & Phishing Report, which highlights the following trends:

•    Tale of .zip and .html Attachments
•    A Phishing Scam Linked to “High School Musical”...

Symantec has been tracking a recent phishing email attack that is targeting the users of a number of prominent global banking institutions. In this phishing attack it was observed that the spammers are using meaningless, random email headers—possibly in an attempt to circumvent anti-spam message filters. The spam attack was observed starting in July and is still active.

Let’s first understand what email headers are. Every email message comprises two parts: the message body and the message header. The header can be thought of as the envelope of the message, containing the address of the sender and the recipient, the subject, and other important tracking information. The body contains the actual textual content of the message and file attachments, if any.

Here are some of the most common email header fields:

Received:
Return-Path:
Sender:
X-Mailer:
From:
Date:
To:
Subject:
Message-ID:
MIME-Version...

In the past couple of months, Symantec has observed phishing attacks on legitimate automotive sales brands that are based in the UK and the USA. These brands help customers to sell new and used vehicles such as cars, motorbikes, etc. The legitimate websites also provide customers with the facility to advertise the vehicles they wish to sell.

There were several phishing sites created to harvest customers’ confidential information. The phishing sites were hosted on free Web hosting domains. In one of the phishing sites the page stated that the brand was offering customers the opportunity to advertise for free. The customer was required to complete an identity verification (that was fake) so as to avail of the free offer. The verification process prompted for the customer’s email address, the ad’s ID, and a security question with its answer. In this attack the fraudsters attempted to convince customers that the phishing page was authentic by providing the...

In August 2010, Symantec observed phishing websites spoofing a social networking brand that was linked to the film “High School Musical.” Typically, phishing sites are created to appear identical to the original website so that end users will find it difficult to distinguish between them. In the past couple of months, some phishing sites that spoofed social networking brands contained Web pages that were a bit different from the original.

So, why are fraudsters creating these phishing pages that aren’t identical to the original? Fraudsters are modifying the phishing site so that the page looks as though the brand was promoting certain ideas. In many instances, the ideas were associated with celebrities, special occasions, pornography, movies, major events, etc. These ideas are incorporated by modifying certain aspects of the phishing site such as the logo of the brand, Web page background, images, and so on.

In this particular phishing site the...