The Spam Report, May 2008

Symantec's monthly spam report for the month of April 2008 shows that while spam may have reached its 30^th birthday at the start of May, there's no sign of volumes of unwanted mail slowing down.

Overall, spam caught at the gateway made up 80% of all mail in April, just one percent below March's record high, and with volumes peaking at 87% through out the month. Biggest culprit for sending spam was the EMEA region, which accounted for 44% of spam mail, followed by North America which generated 27% and Asia Pacific which accounted for 18%.

Product related and online-based spam is still the most prolific type of spam, although financial spam has also increased.

Among the latest tricks and traps set by spammers in April was yet another abuse of Google. Recent months have seen spam attacks that targeted Google's advanced search query and its AdSense service, this time it's the turn of Google's AdWords.

The phishing email was sent out telling end-users that their subscription to the AdWords service, which allows advertisers to target adverts at Google search users, was about to expire, and asking them to clink a link to re-subscribe. The link of course leads to a fraudulent website that then attempts to get the user to register personal data.

Social networking also came in for some abuse during April. One spam email invited users to join a fictional ‘Who's who' network of business professionals, although of course, the site it linked to was harvesting personal data.

Another attack that attempted to exploit the popularity of social networking type sites, consisted of an email that tells the user they have been removed or blocked from the contact list of one of their acquaintances on an instant messaging application. Eager to find out who has decided that they don't want to be friends any more, the user is asked to click a link, and then provide their user name and password, to be abused by spammers at a later date.

Spear phishing - attacks which target specific individuals or organizations - also developed yet another angle, this time in the form of an email that claimed to be a court summons for the United States District Court, for the recipient to appear before a Grand Jury. Unsuspecting users who clicked on the link to download the full fake subpoena, found themselves installing a Trojan keystroke logger instead.

Finally, in a spam attack that seems to show just how far spammers will go to try and capture personal data, spam emails appeared disguised as adverts seeking movie extras for cash - although why any one would want the personal details of broke wannabe actors is a mystery.