June 19, 2009
No Summer Vacation from Spam: Live Email Security Webinar July 15 - and Some New Spam Sightings
Proofpoint's live web seminar series for 2009 continues with "No Summer Vacation from Spam," being held on Wednesday, July 15th 2009 at 11:00 a.m. Pacific/2:00 p.m. Eastern time. You can register here:
No Summer Vacation from Spam - Live Proofpoint Webinar
Proofpoint spam expert Nithin Rao will discuss the latest trends in spam volume, spam composition, spam techniques, emerging malware, blended threats and much more.
And, as if to reinforce the truth of that webinar's title, I see that some of my personal email accounts (which I use as sort of minispam traps -- they don't have spam protection in front of them so I see interesting new spams) have a lot of pretty clever spam and phish in them today.
The top image at left (click it to see full-size example) is a variation on image-based spam from our old friends at "Canadian Pharmacy." The payload is in an image, but there's some legitimate looking hashbusting text in the footer. This is the sort of message that will fool less sophisticated anti-spam solutions.
Interestingly, the click-through URLs for this seem to route to a Yahoo Groups address - which likely redirects to their online store site. Do I need to tell you that it's a bad idea to actually shop there?
The subject line in that one cracks me up... Aw shucks, I've missed you, too, Canadian Pharmacy...
The second example is a pretty convincing looking phishing attack that spoofs Bank of America. We've seen a lot of these in spam traps today and there seem to be similar attacks spoofing Chase, SunTrust and others being widely spammed. (Click the image for a full-sized version.)
In this phishing attack, recipients are being asked to, yes, update their personal information in a "new version of Bank of America Customer Form." The form URL itself is not linked to an actual Bank of America URL, of course, but instead directs to a spoofed site hosted with domain name hflij1.net.
As I've said time and time again in this and other forums: Don't click these kinds of links. If you get a message like this and it inspires you to update your information at your bank or other online service, type the address directly into your browser rather than following a link.
