St. Patrick’s Day is a global celebration of Irish culture and a religious holiday on March 17, and it is very special to Irish communities and organizations. Recently, we have observed numerous St. Patrick’s Day related spam messages flowing into the Symantec Probe Network. Many of the spam samples observed are encouraging users to take advantage of clearance sales of cars as well as other product offers.
Interestingly, in one spam campaign, we observed a malicious spam email that tries to trick users by using the name of the event in conjunction with a popular site that allows users to send and receive large files. By clicking on the link, the user is redirected to a Web page that downloads some malicious code, which exploits several common vulnerabilities. The main motive of these spam campaigns is to lure recipients by taking advantage of the St. Patrick’s day holiday in the subject line and body of the email, such as: “Patrick[RANDOM NUMBERS]”. In such cases, users should be careful and avoid clicking on the links.
Figure1. Malicious spam email taking advantage of St. Patrick’s Day
The spam may lead to a website declaring a clearance sale on St. Patrick’s day.
Figure2. Financial spam targeting St. Patrick’s Day
When the user clicks on the "Get Prices Button” for the clearance prices of cars, they get redirected to another Web page that asks them to select the type of car model for a price comparison.
Figure3. Clearance website to compare the prices of car models
After entering the make and model of the car, the user gets redirected to another Web page asking for their personal details, including their address, email address, and payment details. Users should be wary of such information-stealing attempts by spammers.
Figure4. Asking the user for their personal information
Below are some of the subject lines that we have observed regarding the clearance sale spam attacks for St. Patrick’s Day:
- /*St. Patrick's Day clearance, test drive your new car… .* */
- See Clearance Prices on all XXX Vehicles on St Patrick
- St Patrick' XXX Clearance
- See Clearance Prices on all XXX Vehicles on St Patrick's
- 2013 St Patrick XXX Huge Discount – Slashing prices to meet Quotas
The following example is from a spam email that encourages users to take advantage of bogus offers and purchase products. By clicking the URL, the user is re-directed to a fake pharmaceuticals website.
Figure5. Spam website selling fake pharmaceutical products
Symantec advises our readers to be cautious when handling unsolicited or unexpected emails. We at Symantec are monitoring spam attacks 24×7 to ensure that readers are kept up-to-date with information on the latest threats.
Have a great St. Patrick’s Day!