News & Press releases

PDF stock spam

"Talktech Telemedia expects gains of 300% in next 5 trading sessions!". MX Lab has intercepted the first stock spam messages that don't have content or images attached to the email but instead a full PDF of the German Stock Insider.

"This technique is new and shows that spammers will do anything to fool the receiver and try to avoid detection by anti spam measures." says Peter Louies from MX Lab. "The PDF is of good quality and will make the message more acceptable to be true by using a nice lay out to make it look more official. Even 'Volume 4, Issue 6' is placed on the right top side so that it's more like a newsletter in PDF format."

This PDF is 116 kB big in size and will, when receiving in mass, cause some extra bandwith usage. Other PDF stock spams that have been detected have a size of about 20 kB and include the content of the image based spam that was earlier present in the image based stock spam.

These PDF files are composed like the image based spam with letters out of context to avoid detection by OCR scanning techniques. The subject indicates that a PDF file is present, the body itself remains without any content. The PDF file size remains between 15kB and 20 kB.

It is possible that we will see more PDF based spam during the following days and weeks however but it is too early that we could speak of a new spam campaign based on PDF files.

Image based spam has dropped during the last few months. Instead we see new techniques and a change in strategy during the last few weeks. And this is also the conclusion of other email security providers.

Images don't need to be included in the message but can be linked to the servers of image or file hosting providers like Imageshack, Filehost, Bilder-Hosting and so on or can be integrated as a background in the HTML part of the email.

MX Lab has taken extra measures and will continue to follow up this new technique and evolution in stock spam.