Dusty old spam trick used to send dusty old malware

“Your message could not be delivered”. It’s one of the oldest methods in the social-engineering-for spam-and malware-emails handbook. You are receiving notice that an email you sent has not reached its recipient – so sad.

And of course the attachment must contain the mysterious email. But it doesn’t. It contains a zipped variant of MyDoom malware. (First variants of MyDoom were sited on the 26^th January 2004). The attachment has wall-to-wall VirusTotal coverage of nearly 98% (42 out of 43 engines including Commtouch’s Command Antivirus).

Email Text:

Your message was undeliverable due to the following reason(s):

Your message could not be delivered because the destination computer was not reachable within the allowed queue period. The amount of time a message is queued before it is returned depends on local configura- tion parameters.

Most likely there is a network problem that prevented delivery, but it is also possible that the computer is turned off, or does not have a mail system running right now.

Your message could not be delivered within 6 days:

Host —– is not responding.

The following recipients could not receive this message:

Commtouch’s labs have seen a significant increase in the number of websites infected with malware. There are currently 34% more malicious sites listed in Commtouch’s GlobalView URL filtering database than there were when we reported Web security statistics as part of our April Quarterly Threats Trend Report.

Log Out

A recent example: This LinkedIn invitation email led to a site with a Blackhole exploit kit.

The number of phishing sites detected has also increased, but only marginally (3.6%) over the same period. Phishing attacks aim at the usual targets such as PayPal. The attack below is hidden inside a legitimate site.

Entering login details on the well-crafted landing page leads to a further “enter your information” page that wants ALL your data: date of birth, social security number, phone and address, credit card details, and ATM PIN (!).

Finally the phishing site confirms that you have entered all required data before forwarding you to a genuine PayPal login screen.