Spammers Targeted the Smartphone Users

Smartphone and tablet users are targetted by emergence of email spam, mass mailings containing malware for Android-based devices.

Currently these programs are not appearing in huge numbers, but they are sent out regularly. In Q1 saw yet another trend: fake notifications distributed in spam are now imitating messages from mobile applications. 

According to Securelist, spammers especially like the cross-platform mobile application WhatsApp: notifications sent on behalf of this application were used by spammers to spread both malware and standard adverts.

In January, we registered a mass mailing which supposedly contained an image sent to the recipient via WhatsApp. An alert user would have queried why this notification had arrived via email as the WhatsApp account is not directly associated with the email box. 

However, many users are used both to synchronization of their contacts and to the fact that messages from mobile applications can arrive via email so this notification would not surprise the majority of users.

Spammers often create "background noise" in the text, i.e. adding random characters, words or text fragments. Obviously, the message becomes less readable and therefore less interesting for the user. That's why spammers usually try to hide the random text from the user. 

Percentage of spam in email traffic in 2014

These old methods, such as placing white text on a white background or simple separation of the "noisy" text from the main content by numerous line breaks, are still widely used by spammers even though these tricks are as old as spam itself.

However, some spammers are using more advanced techniques. One of them is to create background noise with HTML tags. This method ensures that the user will not see anything other than the main content while for the spam filter each email will be unique.

spam sources by country in 2014

The most popular malicious program spread by email in the first quarter of the year. This malicious program is designed to look like an HTML page used as a registration form for online banking services. It is used by phishers to steal financial information.

In second and seventh places came the Net-Worm.Win32.Aspxor worms. These net worms are designed to spread spam. They automatically infect sites, load and run other programs, and collect valuable information stored on the computer such as passwords and other data to access email and FTP accounts.

Email-Worm.Win32.Bagle.gt, a long-time resident of the Top 10, came third. The main functionality of any worm is to harvest email addresses found on an infected computer. The Bagle worm can also accept remote commands to download malicious files from the Internet without the user's knowledge.

Fourth and eighth places were occupied by Fareit family Trojans, which were most actively distributed in January. These programs were designed to steal user logins and passwords, launch DDoS attacks and download and run random software. The two samples from our rating could download and run Zbot Trojans. In addition, Fareit Trojans can steal Bitcoin wallets as well as other crypto-currency wallets (about 30 in total)

Trojan.Win32.Bublik.bwbx is in fifth. This program downloads other malware, specifically the Zbot family of Trojans, onto the victim computer.

Backdoor.Win32.Androm.bngy came sixth. The Andromeda family of malware consists of backdoors that allow cybercriminals to secretly control a compromised computer. Machines infected by these programs often become parts of botnets.

Email-Worm.Win32.Mydoom.l, a well-known mail worm, was ninth in the rating.

The Top 10 for Q1 was completed by a notorious Trojan from the Zbot family. Zbot is a family of Trojans that steal confidential user information. It can also install CryptoLocker , a malicious program that demands money to decrypt user data.




Author Venkatesh Yalagandula Follow us Google + and Facebook and Twitter