Tag Archives: Message Filter

What Spam Would Mom Like This Year?

On May 11, 2014, many countries will celebrate Mother’s Day. Plenty of online articles have been giving gifts ideas and advice for making the day special for mom. Companies have also been sending a huge number of promotional emails with a special message about Mother’s Day. Unsurprisingly, spammers have been exploiting this occasion to send out a fresh batch of spam.

Symantec started observing Mother’s Day spam from early April and we have seen a steady increase in the volume of messages ever since. Previous Mother’s Day spam emails often stuck to certain categories. Spam emails offering flower deliveries, jewelry, personalized messages, coupons, and other gifts for mothers were the most common. Survey and product replica spam were also observed in the past.

The following are the major Mother’s Day themed spam campaigns seen this year.

Flowers for Mother
A beautiful bunch of flowers is something any mother will love and spammers use this theme more than any other. From last month, we have seen numerous emails promising flower deliveries by Mother’s Day. Most of these emails included links that redirected to fraudulent websites and some of the links redirected through multiple domains just to increase the traffic.

Figure 1. Preview of a spam email for ordering flowers

The email headers for this category are as follows.

Subject: $19.99 for Flowers and a Vase for Mother’s Day
From: [brand] <Online@[domain]>

Subject: [brand]: $19.99-Flowers for-Mom &-Vase!
From: “[brand] Special” <[brand]Special@[domain]>

Subject: Hi, 50% off Flowers for Mom
From: Fresh Flowers <[brand]@[domain]>

Personalized jewelry for Mom
Beautiful jewelry, particularly rings and pendants with a personalized inscription, is another theme that is a hit around Mother’s Day. Spammers also claim to offer personalized cards or notes along with the product. Like most spam, these emails will usually have links to other sites.

Figure 2. Preview of a spam email selling personalized rings for Mother’s Day

The email header for jewelry-themed spam messages are as follows.

Subject: Give Mom Something Unique This Year
From: Mothers Rings <rings@[domain]>

Product replica spam
This category is not too different from others, except that these spam emails advertise websites selling fake watches, jewelry, and other expensive goods. We observed these emails earlier this year and we continued to see them today. In these campaigns, the spammers give users deadlines for placing orders for the products.


Figure 3. Preview of replica spam related to Mother’s Day

Email headers seen with this spam campaign are as follows.

Subject: Why so soon?
From: Paige (Mother’s Day deadline) <Paige@[domain]>  

Lose weight by Mother’s Day
We believe that Mother’s Day-themed weight loss medication spam is a spinoff from an ongoing weight loss spam campaign, which has been the largest spam category by volume over the last couple of weeks. These emails include links which redirects to fake news sites offering information about new weight loss products.

Subject: Drop 10LB by Mothers Day
From: Rid 20 Pounds 2 Weeks <Sophia@[domain]>

Portuguese promo spam
We have seen a Portuguese spam campaign sending a large volume of messages promoting products related to Mother’s Day. This spam campaign uses the name of an online site which sells personalized products.

This spam campaign included links redirecting to a fraudulent website, along with a bogus opt-out option.

Figure 4. Preview of Portuguese promotional spam exploiting Mother’s Day

Here is the email header for this spam campaign.

Subject: Dia das Mães! Ajudaremos você com o presente.
From: “[brand]OnLine” <envio@painel1.[domain]>

Subject: Mother’s Day! We’ll help you with this.

Symantec has observed a high volume of Mother’s Day themed hit-and-run spam recently. Most of these emails included links to a .us top level domain (TLD) which, on further analysis, were found to be registered quite recently. The theme of the domain names show that they were created for a Mother’s Day spam campaign. The domain names followed patterns such as flower-1promo-mothersday and mothersdayflower-special.

Symantec antispam filters successfully blocked these spam mails, but as always, we advise our readers not to respond to any of these emails. Remember, take your time to search for a Mother’s Day gift and don’t just click on links found in these spam mails. Symantec wishes all of our customers a happy Mother’s Day.

Heartbleed ????????????????

      No Comments on Heartbleed ????????????????

寄稿: Binny Kuriakose

シマンテックは最近、Heartbleed 脆弱性に便乗したフィッシングメールを確認しました。このフィッシング攻撃は、米軍関係の保険サービスを装って Heartbleed 脆弱性に関するメッセージを送信し、情報を収集しようとします。

Heartbleed は最近発見されたセキュリティ脆弱性で、OpenSSL のバージョン1.0.1 から 1.0.1f に影響します。この脆弱性は OpenSSL 1.0.1g で修正済みです。脆弱性の詳細や対処方法については、シマンテックのセキュリティアドバイザリーを参照してください。



図 1. Heartbleed 脆弱性に便乗したフィッシングメール


  • X-Mailer ヘッダーを見ると、送信者が使っている電子メールクライアントが非常に古いもの(Microsoft Outlook Express 6.00.2600.0000)だと分かります。多くのユーザーが依然として古い電子メールクライアントを使っていますが、最新のオンラインビジネスでそのような電子メールクライアントを使ってセキュリティに関する通知を送信することはほぼありません。
  • 「has initiate」という文法上の誤りがあります。攻撃者は、最新の話題をいち早く悪用して新しいフィッシング攻撃を実行しようと焦るため、文法の間違いを犯しがちです。また、送信者の母国語が英語ではないことも珍しくありません。
  • さらに、このフィッシングメールは有名な米軍関係の保険サービスからのセキュリティ警告と称しているにもかかわらず、掲載されている「ログイン」リンクをクリックすると、実際には危殆化したトルコの製造業社のサイトにアクセスします。


Heartbleed に関するアドバイザリーで詳しく説明しているように、個人情報の提供や更新を要求する電子メールには警戒するようにしてください。また、そのようなメッセージに含まれるパスワードリセットやソフトウェア更新のリンクは、決してクリックしないでください。個人情報の更新や変更が必要な場合は、該当する Web サイトに直接アクセスして実行することをお勧めします。


* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。

Phishers Pump out Heartbleed Attacks

      No Comments on Phishers Pump out Heartbleed Attacks

Contributor: Binny Kuriakose

Symantec has recently detected phishing emails related to the Heartbleed Bug. The phisher attempts to gather information by posing as a US military insurance service with a message about the Heartbleed bug.

The Heartbleed bug is a recently discovered security vulnerability affecting OpenSSL versions 1.0.1 to 1.0.1f. This vulnerability was fixed in OpenSSL 1.0.1g. Symantec’s security advisory gives more details on the bug and offers remediation steps.

Spammers and phishers are known to use trending news and popular topics to disguise their payloads. In the case of phishing emails, phishers often cite security concerns to legitimize and disguise their social engineering methods. The payloads of these emails attempt to compel the messages’ recipients into divulging sensitive information.

In this case, the phishers send the following email.

Figure 1. Preview of the Heartbleed phishing mail

There are several interesting attributes of this example which should be pointed out. 

  • According to the X-Mailer header, the sender is using a very old mail client (Microsoft Outlook Express 6.00.2600.0000). Although there are plenty of users still utilizing old email software, it is highly unlikely that a modern online business would be using a desktop mail client to send out security notifications.
  • Notice the unusual grammar with the usage of “has initiate”. Often, phishers will attempt to quickly capitalize on a new topic. In doing so, they will usually make grammatical errors due to the pressures of sending out a new phishing campaign as soon as possible. Also, phishing emails are often sent by people who don’t speak English as their first language.
  • Additionally, the phishing email purports to be a security alert from a reputable US military insurance service but contains a “Sign In” page that actually points to a compromised Turkish manufacturing site.

Although this is not an exhaustive list of identifying factors for phishing emails, it highlights some of the irregularities and inconsistencies often seen in phishing campaigns.

As detailed in the official Symantec Heartbleed Advisory, Symantec warns users to be cautious of any email that requests new or updated personal information. Users should not click on any password reset or software update links in these messages. If users need to update or change their personal information, it is best to do so by directly visiting the website.

Aprovechan Interés en Adopción de Bebés para Estafas Electrónicas

Una variación de la popular estafa cibernética 419 (419 email scam) está siendo usada por defraudadores electrónicos para aprovecharse de parejas desesperadas por adoptar un niño(a). Una vez que los interesados han sido cuidadosamente involucrados en un proceso de adopción falso, se les pide dinero para cubrir los trámites legales y administrativos.

Aunque los más recientes fraudes 419 se basan principalmente en la inocencia de las víctimas (más que en la ingenuidad por parte de los spammers, quienes distribuyen los correos), algunos defraudadores están empezando a hacer mayores esfuerzos por comunicarse directamente con la víctima para ganarse su confianza. La investigación que hizo Symantec sobre este tipo de fraudes electrónicos reveló que están bien preparados, se presentan de forma convincente y pueden tomar hechos de la vida real para hacer que sus historias sean más creíbles y más coherentes ante cualquier sospecha. 

Aunque los fraudes de adopciones falsas ya se habían visto antes, en esta ocasión Symantec observó detalles de antecedentes de la vida real y a defraudadores que hacen un gran esfuerzo por enganchar a sus víctimas.


Figura 1. Correo fraudulento sobre tema de adopción usado para fraude en línea

En lugar de usar historias comunes, donde se ofrece un premio de lotería en el extranjero o se habla de un líder africano que está por morir, este tipo de estafas tiene un enfoque diferente. Por ejemplo, en el correo que Symantec identificó había muchas señales que indicaban que era un fraude, como que, por ejemplo, el mensaje se envió a destinatarios ocultos (a través de cuentas de correo hackeadas, originarias de Hungría pero enrutadas a través de Italia) y el correo requería responder a un proveedor de correo diferente. Estas son características típicas de un fraude donde suele hablarse de una cantidad de dinero inicial, así que decidimos investigar a fondo para averiguar cómo el defraudador pretendía pedir el dinero.

En un intento por hacer que todo pareciera lo más legítimo posible, el estafador cibernético nos hizo pasar por varias etapas antes de finalmente pedir que enviáramos dinero. Durante nuestro intercambio de mensajes –que consistió de 11 correos electrónicos durante dos meses- nos informó con gran detalle sobre la historia de la madre y nos explicó sobre las regulaciones que tienen que ver con una adopción privada e independiente. Incluso nos enviaron un formato falso de adopción, junto con fotos del bebé.


Figura 2. Fotos de bebés ofrecidos en adopción forman parte de esta campaña de estafas 419 


Figura 3. Formato de adopción falso usado para ganarse la confianza de la víctima 

Cuando el defraudador finalmente decidió pedirnos dinero, se nos solicitó que enviáramos $2,500 dólares para cubrir la “Cuota para la Preparación de la Orden del Tribunal y Documentación”. Esto debía realizarse en un primer pago de $1,500 dólares y otro de $1,000 mediante transferencias electrónicas. Es probable que el defraudador pidiera los pagos de esta manera para que la transacción pareciera más legítima y tuviéramos más confianza.


Figura 4. El defraudador solicita el dinero por la adopción del bebé  

Cuando el defraudador proporcionó un nombre y una dirección para recibir el envío del pago, asumimos que esta información era falsa. Sin embargo, buscamos la dirección y esto nos llevó a un descubrimiento sorprendente.

La dirección de la persona a quien deberíamos pagarle era la de un abogado legítimo de Asuntos Familiares y Adopciones (que no tenía nada que ver con este tipo de fraude cibernético). Esto es algo diferente pues generalmente la mayoría de los defraudadores usan un nombre falso, sin embargo, robar la identidad de una persona real puede hacer que el fraude parezca más convincente. La posible víctima, sospeche algo o no, puede buscar el nombre y confirmar que se trata de un abogado legítimo que labora en Estados Unidos. Así que todo parece ser congruente y entonces envían el dinero y con eso se convierten en una víctima consumada del fraude.  

La ejecución de este fraude cibernético relacionado con el tema de una adopción muestra un nuevo enfoque por parte de los estafadores 419, algunos de los cules han regresado al punto de origen en su enfoque. En una entrevista con The Economist hace dos años, revelé como algunos defraudadores de este tipo han pasado de enviar mensajes de fraude que parecen oficiales y legítimos a misivas mucho menos profesionales donde se ofrecen grandes cantidades de dinero en escenarios poco probables. Ninguna de estas estafas son muy sofisticadas porque los defraudadores buscan víctimas que se “auto-eligen”.

Este ejemplo de estafas en línea sirve para recordar a los usuarios que no en todos los fraudes donde se pide dinero por adelantado son intentos por lograr que la víctima más crédula caiga en ellos. Algunos defraudadores usan tácticas creativas (como ésta, que durante meses tuvo detalles de antecedentes convincentes y formatos que parecían oficiales). De esta forma, no hay duda de que la imaginación de los estafadores cibernéticos y su creatividad seguirán evolucionando.


      No Comments on ??????????????????????????????

寄稿: Azam Raza




差出人: “WorldOfWatches” <johnwatson@[削除済み]>
件名: Challenge Ends Easter weekend(イースターの週末、今こそチャンス)

差出人: “DailyPromos” <aacpu@[削除済み]>
件名: Our pick today is- easter14(本日の特選品 – Easter14)

Easter Spam 1.png

図 1. イースターにちなんだ模造品スパム


Easter Spam 2 edit.png

図 2. イースターにちなんだ医薬品スパム


差出人: “Mackenzie Burns” <monday@[削除済み]>
件名: Begin eating this fruit and lose the fat before Easter Sunday(このフルーツを食べて、今からイースターサンデーまでに脂肪を落とそう)

大手の小売店やブランドショップは、祝祭日に向けてディスカウントやセールを展開しますが、スパマーもそれに便乗しています。スパマーが有名小売店やブランドから発信されたように電子メールを偽装するのは定番ですが、たいていは偽サイトへのリンクが掲載されています。プレゼントのクーポン券進呈を謳う手口も広く使われています。この手のスパムで紹介されている商品は、子供のおもちゃから SUV まで多種多様です。この手のスパムメールで使われているヘッダーには、次のようなものがあります。

件名: Spring Sale Event on all Cars, Trucks, and SUVs!(乗用車からトラック、SUV まで、春の特別セール中!)

差出人: Auto-Dealer-Online <williamw@[削除済み]>

Easter Spam 3 edit.png

図 3. イースターのバナーが表示されている商品紹介スパム

Easter Spam 4 edit.png

図 4. 今年確認されたプレゼントクーポンスパム


差出人: Easter Bouquets <rebekkahFAjhLg@[削除済み]>
件名: Make the Easter bunny jealous! Easter flowers(イースターバニーに見せつけちゃおう! イースターに花束を)

Easter Spam 5 edit_0.png

図 5. イースターバニーから子供に名前入りの手紙が届くと謳うスパム


差出人: AU_AllSlots @ <AllSlots@[削除済み]>
件名: 25-free spins on Gold-Factory this-Easter(今年のイースターに Gold-Factory スロットでコイン 25 枚分を進呈)

419 詐欺スパム
ナイジェリアスパムは、宝くじの当選金や寄付金などを餌にして、どの祝祭日にも決まって登場します。シマンテックは、孤児院や慈善団体を詐称して不幸な子供への寄付金を募る 419 スパムを確認しています。個人情報を求めてくる迷惑メールは、常に慎重に扱う必要があります。この手のスパムメールで使われているヘッダーには、次のようなものがあります。

差出人: suzanne122@[削除済み]
件名: HappyEasterInAdvance,(一足早くハッピーイースター)


差出人: “Cupcake” <contato@[削除済み]>
件名: Páscoa                                                          | 件名: Easter(イースター)

差出人: Пасхи <vamdetal@[削除済み]>                     | 差出人: pasha
件名: Скоро Пасха                                                  | 件名: Almost Pasha(もうすぐイースター)

差出人: Пряники <sladkie.pashi@[削除済み]>           | 差出人: Gingerbread
件名: Кондитерская мастерская                              | 件名: Confectionery masterskaâ(お菓子工房)



* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。

?????????? 419 ??

      No Comments on ?????????? 419 ??

養子を熱望している夫婦を狙って 419 詐欺のバリエーションを利用する、新手の詐欺が発生しています。その巧妙な手口に騙されて偽の養子縁組み話に乗ってしまうと、被害者は弁護士費用や行政手続き費用を支払うよう求められます。

最近の 419 詐欺のほとんどは、スパマー自身の独創性ではなく被害者の無防備さに頼っていますが、一部の詐欺師は被害者と直接の対話を進めることで信用を勝ち取ろうと考え始めたようです。十分に調査された手口で説得力もあり、ときには話に信憑性を持たせ、詳しく調べられてもボロが出ないように、実話を拝借する場合さえあります。



図 1. 養子縁組み話を悪用する詐欺メール

海外の宝くじに当選した、あるいは裕福なアフリカの指導者が死去したなどという筋書きで前渡し金詐欺を仕掛ける典型的な手口の代わりに、今回の詐欺師は、変わったアプローチを取っています。それでも、詐欺を疑わせる兆候は多く見受けられ、たとえばメッセージは匿名の受信者に宛てて送信されています(ハッキングされた Web メールアカウントが利用されており、発信元はハンガリーですがイタリアを経由しています)。また、別の Web メールプロバイダに返信するよう求めてきます。いずれも、前渡し金詐欺によく見られる特徴ですが、詐欺師がどのような方法で金銭を要求してくるのか実際に調べてみることにしました。

この養子縁組み話に少しでも信憑性を持たせようとして、詐欺師は最終的に送金という段になるまでに、いくつもの手続きを用意しています。メールをやり取りするうちに(11 通の返信が必要で、期間は実に 2 カ月にわたりました)、子供の母親についても詳しく語られる一方、公的な斡旋を利用しない私的な養子縁組みに伴う規則についても説明がありました。さらには、偽の養子縁組み書類と新生児の写真まで送ってくるほど用意周到です。


図 2. 419 詐欺で養子縁組みの対象とされた乳児


図 3. 被害者の信頼を得るために用意された偽の養子縁組み書類

最終的に金銭を要求できると詐欺師が判断した段階まで進むと、ユーザーは「裁判所命令の作成ならびに文書費用」に充当するとして 2,500 ドルを要求されます。支払いは、金融機関の電信送金を利用して、1,500 ドルと 1,000 ドルの 2 回に分けて行うよう指示されます。このような支払い方を要求してくるのも、正規の取引であるかのように演出し、被害者がこの詐欺を本物と信じ込むようにするためだと考えられます。


図 4. 詐欺師が養子縁組みの費用を請求してくる


記載されている受取人の住所は、養子ならびに家族法を扱う弁護士事務所の住所だったのです(もちろん、この弁護士は詐欺とはまったくの無関係です)。ほとんどの詐欺師は、昔からの偽の名前を使って前渡し金詐欺を実行するものですが、実在の人物の身元を乗っ取って使うほうが、詐欺の説得力は増します。標的が無警戒であれば、受取人の名前を探し出して、その人物が本当に米国内で事務所を構えている正規の弁護士だと信じてしまうかもしれません。こういった要素が重なって、最終的にお金を支払うと、新たな被害者の 1 人となってしまいます。

このように養子縁組み詐欺を使うのは、419 詐欺の手口として新たな傾向ですが、詐欺師の一部はちょうど一周して以前の特徴に戻っただけなのかもしれません。筆者は 2 年前のエコノミスト誌によるインタビューで、前渡し金詐欺の詐欺師から送られてくるメッセージが、いかにも正規で本物らしく見える文面から、現実味に乏しいほどの大金で誘う、およそプロらしくない内容に移り変わった経緯を明らかにしました。自ら引っ掛かってしまうような被害者を狙っているため、どの詐欺メッセージも巧妙とはほど遠いものです。



* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。

Prepare-se para os Spams durante a Páscoa

A Páscoa, como muitas outras datas comemorativas, deveria significar um dia de alegria, o que obviamente remete a presentes, compras e festas. Porém, essa animação não é a única coisa que está sendo espalhada neste feriado. Os Spammers também começaram a difundir seu trabalho vicioso. A poucos dias da Páscoa, o volume de Spams cresceu significativamente.

A cada ano que passa, a Symantec observa certas categorias de Spam utilizando a Páscoa como tema central e este ano não foi diferente. Vamos ver abaixo alguns dos diferentes tipos de Spam que a Symantec coleta ano após ano bem como alguns exemplos coletados este ano.

Spams de Bens de Consumos

Com presentes sendo o item mais importante de qualquer data comemorativa, Spam de produtos (especialmente bens de consumo) é a categoria de Spam que a Symantec mais observa. Nesse tipo de Spam, itens como relógios e joias falsificadas  são promovidos usando slogans e belas imagens de produtos. O cabeçalho do e-mail inclui exemplos como:

De: “WorldOfWatches” <johnwatson@[REMOVED]>

Assunto: Desafio termina no fim de semana de Páscoa

De: “DailyPromos” <aacpu@[REMOVED]>

Assunto: Nossa sugestão hoje para a Páscoa 2014

Easter Spam 1.png

Imagem 1: Tema de Páscoa replica bom spam

Spams Médicos e Farmacêuticos

Spams de remédios e farmácias são outra categoria de Spam que vemos muito quando chegamos perto das datas comemorativas. Esses Spams normalmente contém algum link para sites de farmácias que fingem vender medicações online sem a necessidade de receitas médicas. Esses sites normalmente exibem banners festivos para criar um clima mais realista.

Easter Spam 2 edit.png

Imagem 2: Temas médicos de Spam de Páscoa

Spams específicos para quem quer perder peso são uma subcategoria dos Spams médicos que são vistos em muitas línguas diferentes. Medicações para perda de peso exibidas nessas mensagens variam de medicações reconhecidas pelo mercado bem como extratos de ervas e plantas exóticas. O cabeçalho do e-mail inclui exemplos como:

De: “Mackenzie Burns” <monday@REMOVED>

Assunto: Começe a comer essa fruta diariamente e perca gordura antes da páscoa!

Spams de Produtos

Grandes lojas de varejo e marcas oferecem inúmeros descontos e promoções durante as datas comemorativas e os Spammers se aproveitam disso. Spammers geralmente constroem seus E-mails para que pareçam vir de conhecidas marcas e lojas de varejo, mas normalmente eles possuem links redirecionando para sites falsos. Ofertas para cupons de presentes também são muito comuns. Os produtos vistos nesse tipo de Spam variam desde brinquedos até Veículos. O cabeçalho do e-mail inclui exemplos como:

De: Auto-Dealer-Online <williamw@[REMOVED]>

Assunto: Promoção de Outono para todos os carros, Jipes, Caminhonetes e SUVs

Easter Spam 3 edit.png

Imagem 3: E-mail com banner de spam

Easter Spam 4 edit.png

Imagem 4: Spam de cupom de presente de Páscoa

Spam de Presentes Personalizados

Presentes e lembranças personalizadas também estão ficando populares este ano e Spams promovendo mensagens personalizadas em ovos de páscoa e coelhinhos da páscoa está se mostrando popular entre os Spammers. A maioria desses Spams possuem links para sites falsos e alguns deles redirecionam o usuário a sites com conteúdo inapropriado.  O cabeçalho do e-mail inclui exemplos como:

De: Easter Bouquets <rebekkahFAjhLg@[REMOVED]>

Assunto: Deixe o coelhinho da Páscoa com inveja! Flores de Páscoa!

Easter Spam 5 edit_0.png

Imagem 5: Spam personalizado para crianças

Spam de Cassinos

Jogos online e Spams de cassinos aparecem em grande volume durante a época das datas comemorativas. Spams de cassinos provocam as vítimas com bônus na inscrição, recompensas em pontos e chances de ganharem fortunas. O cabeçalho do E-mail inclui exemplos como:

De: <suzanne122@[REMOVED]>

Assunto: Nessa páscoa, jogue gratuitamente no Cassino Gold Factory

Spam de Fraudes

Spams de fraudes monetárias rotinamente dão as caras durante essa época do ano. A Symantec observou muitos Spams fingindo serem de orfanatos ou instituições de caridade buscando doações para os menos afortunados. E-mails desconhecidos pedindo informações pessoais sempre deveriam ser tratados com cuidado. O cabeçalho do E-mail inclui exemplos como:


De: <suzanne122@[REMOVED]>

Assunto: Feliz páscoa adiantado

Outra coisa que nos chamou a atenção esse ano foi o alto volume de Spams de páscoa em outras línguas. O ataque de Páscoa normalmente contém presentes e brindes, como o Spam de entrega de Cupcakes e Ovos de Páscoa mostrados aqui:


From: Пасхи <vamdetal@[REMOVED]>                   | From: pasha

Subject: Скоро Пасха                                                | Subject: Almost Pasha

From: Пряники <sladkie.pashi@[REMOVED]>         | From: Gingerbread

Subject: Кондитерская мастерская                      | Subject: Confectionery masterskaâ

A Symantec deseja um Feliz Páscoa para todos os seus usuários e também aconselha muito cuidado com essas campanhas de Spams. Sempre tenha atenção com e-mails desconhecidos ou inesperados. Nunca clique em links de e-mails que pareçam suspeitos. Lembre sempre de manter seus softwares de segurança atualizados para lhe proteger e poder lhe fornecer a paz de espírito para comemorar e celebrar uma maravilhosa Páscoa.

Bebês Oferecidos para Adoção em 419 Scam

Uma variação de 419 scam de e-mails está sendo usada por fraudadores para tirar proveito de casais desprotegidos que querem adotar um bebê. Cuidadosamente as vítimas são atraídas para um falso processo de adoção, que em seguida, solicita dinheiro para cobrir despesas jurídicas e administrativas.

Enquanto a maioria dos últimos 419 golpes estão ligados à simplicidade e ingenuidade das vítimas, alguns criminosos online já começam a fazer um grande esforço para se comunicar diretamente com a vítima para conquistar a sua confiança. Os golpes são bem estudados e apresentados de forma convincente, inclusive demonstram histórias de vida real para deixá-los mais autênticos.


Figura 1. e-mail malicioso usando uma história de adoção

Ao invés de usar os discursos mais populares para simular fraudes online usuais, tais como ganhar na loteria ou a morte de uma pessoa famosa, este tipo de fraudador adota uma abordagem diferente. A mensagem acima foi enviada para destinatários ocultos (por meio de uma conta de webmail hackeada originária da Hungria, mas encaminhada a partir da Itália) e exigia uma resposta a um diferente remetente. Estas são características típicas de um golpe de pagamento antecipado. Por isso, a Symantec decidiu investigar mais a fundo para ver como o cibercriminoso pedia dinheiro em troca de um serviço falso.

Com a finalidade de tornar esta narrativa de adoção a mais legítima possível, o fraudador nos fez passar por várias fases antes de, finalmente, chegar ao ponto em que fomos convidados a enviar dinheiro. Durante a nossa correspondência que se estendeu por 11 mensagens de respostas e réplicas de e-mail – durante mais de dois meses – o criminoso digital nos informou com riqueza de detalhes a história da mãe da criança e os regulamentos envolvidos para a adoção privada e independente. Eles ainda foram tão longe a ponto de fornecer um formulário de adoção falso e fotos do bebê.


Figura 2. Fotos dos bebês oferecidos para adoção


Figura 3. Formulário falso de adoção usado para convencer as vítimas

Quando o fraudador finalmente decidiu pedir dinheiro, a quantia solicitada foi de US$2.500 para cobrir as taxas de entrada do processo de adoção no tribunal. Inclusive, o cibercriminosos informou a forma de um pagamento em duas parcelas – uma de US$ 1.500 e outra de US$ 1.000 – via transferência bancária eletrônica. O criminoso solicitou que os pagamentos fossem enviados desta forma para a transação parecer mais legítima e a vítima ter mais confiança no esquema.


Figura 4. E-mail do crimonoso virtual pedindo dinheiro

Quando o fraudador fornecia um nome e endereço para receber o pagamento por transferência bancária, assumimos que essa informação era falsa. No entanto, olhando para este endereço, de forma aprofundada, tivemos uma descoberta surpreendente.

O endereço solicitado para o envio era do escritório de um legítimo advogado especializado em adoção e leis familiares (que não possuía nenhuma conexão com este esquema). Isso comprova que a maioria dos criminosos utiliza qualquer nome falso para cometer uma fraude de pagamento antecipado, roubando a identidade de uma pessoa real para a fraude parecer mais convincente. O alvo desavisado pode procurar o nome e confirmar que a pessoa é um advogado legítimo que atua Estados Unidos. Tudo ”faz sentido”, eles enviam o dinheiro e se tornam mais uma vítima da fraude.

A execução deste golpe de adoção sinaliza uma nova abordagem com 419 e-mails de SCAM. Em entrevista à The Economist, há dois anos, foi relevado pela Symantec como alguns fraudadores de pagamento antecipado mudaram a sua abordagem e enviam mensagens de e-mail que parecem legítimos. Nenhuma destas narrativas é muito sofisticada, isto porque os golpistas procuram vítimas que se “auto-selecionam”.

Este exemplo serve como um lembrete de que nem todos os esquemas fraudulentos de pagamento antecipado são tentativas ociosas para obter das vítimas mais ganhos financeiros. Alguns fraudadores usam táticas criativas, como esta narrativa sobre adoção, com convincentes detalhes da vida do bebê e formulários aparentemente oficiais. Não há dúvida de que a imaginação e criatividade dos criminosos vai continuar a evoluir no futuro.

Expect Beautifully Packaged Spam along with Your Easter Gifts!

Contributor: Azam Raza

Easter, like all other celebrations is meant to be a day of jubilation, which of course means gifts, shopping, and spreading cheer. However, cheer is not the only thing that is being spread this holiday. Spammers have also started spreading their handiwork. With just a few days left before Easter, the volume of spam is on the rise.

Each year Symantec observes certain categories of spam using Easter as a theme and this year is no different. Let’s take a look at some of the different types of spam Symantec sees year-over-year, as well as some samples from this year.

Replica goods spam
With gifts being at the core of many major celebrations, product spam (replica goods spam in particular) is the spam category Symantec observes the most. In this spam, items such as fake watches and jewelry are promoted using catchy subject lines and product images. Email header examples include:

From: “WorldOfWatches” <johnwatson@[REMOVED]>

Subject: Challenge Ends Easter weekend

From: “DailyPromos” <aacpu@[REMOVED]>
Subject: Our pick today is- easter14

Easter Spam 1.png

Figure 1. Easter themed replica goods spam

Health spam
Pharmacy or medication spam is another spam category we see a lot of when we get close to any holiday season. These spam mails usually contain links to pharmacy sites which pretend to sell medication online without prescription. Season’s greetings are usually displayed as banners on these sites to add a festive touch.

Easter Spam 2 edit.png

Figure 2. Easter themed pharmacy spam

Weight loss spam is another subcategory of health spam which is seen in multiple languages. Weight loss medicines touted in these messages range from approved medication to stories about herbal extracts from exotic plants. Email header examples include:

From: “Mackenzie Burns” <monday@[REMOVED]>

Subject: Begin eating this fruit and lose the fat before Easter Sunday

Product spam
Major retailers and brands offer large discounts and sales during holiday celebrations and spammers take advantage of this. Spammers often craft their emails to make them appear to be from known retailers and brands but they usually include links leading to fake sites. Offers of gift coupons are also common. The products seen in this type of spam can range from kids toys to SUVs. Email header examples include:

Subject: Spring Sale Event on all Cars, Trucks, and SUVs!

From: Auto-Dealer-Online <williamw@[REMOVED]>

Easter Spam 3 edit.png

Figure 3. Product spam with Easter banner

Easter Spam 4 edit.png

Figure 4. Gift coupon spam seen this season

Personalized gifts
Personalized gifts are getting popular these days and spam promoting personalized messages on Easter eggs and Easter bunnies are proving popular among spammers. Most of these spam mails have links to fake sites and some of them even have links to inappropriate content. Email header examples include:

From: Easter Bouquets <rebekkahFAjhLg@[REMOVED]>

Subject: Make the Easter bunny jealous! Easter flowers

Easter Spam 5 edit_0.png

Figure 5. Spam offering personalized Easter bunny letters for children

Casino spam
Online casino and gambling spam show up in larger volumes during holiday periods. Casino spam entices victims with a signup bonus, reward points, and chances of winning a fortune. Email header examples include:

From: AU_AllSlots @ <AllSlots@[REMOVED]>

Subject: 25-free spins on Gold-Factory this-Easter  

419 scam spam
Nigerian spam routinely makes the rounds during all holiday festivals with news of lucky draws and donations. Symantec has observed 419 spam pretending to be from orphanages and charity organizations asking for donations for the unfortunate. Unsolicited emails asking for personal information should always be treated with caution. Examples of email headers include:

Subject: HappyEasterInAdvance,

From: suzanne122@[REMOVED]

Something else which caught our attention this year is the volume of Easter spam in foreign languages. Easter themed attacks in foreign languages are usually about gifts and goodies, like the cupcake and gingerbread delivery spam shown here:


Subject: Páscoa                                                             |Subject: Easter

From: “Cupcake” <contato@[REMOVED]>


From: Пасхи <vamdetal@[REMOVED]>                       | From: pasha

Subject: Скоро Пасха                                                    | Subject: Almost Pasha

From: Пряники <sladkie.pashi@[REMOVED]>             | From: Gingerbread

Subject: Кондитерская мастерская                              | Subject: Confectionery masterskaâ

Symantec wishes all our customers a very happy Easter, and we also advise you to be cautious of these spam campaigns. Always exercise caution when dealing with unsolicited or unexpected holiday themed emails. Do not click on links in emails that look suspicious. Remember to update your antispam signatures to safeguard your personal information and give you the peace of mind to celebrate the wonderful Easter celebrations.

Babies Offered for Adoption in 419 Scam

A variation on the 419 email scam is being used by fraudsters to take advantage of couples desperate to adopt a child. Once they are carefully lured into a fake adoption process, the victims are then asked for money to cover legal and administrative fees.

While most recent 419 scams rely more on the naivety of victims than any ingenuity on the part of the spammer, some fraudsters are beginning to make more of an effort to directly communicate with the victim to secure their confidence. Their scams are well researched, convincingly presented and may borrow stories from real life to make their stories more authentic and better able to withstand a little scrutiny.

While fake adoption scams have been seen from time to time before, in this instance Symantec observed real life background details and a scammer who goes to great lengths to engage with the victim.


Figure 1. Scam email using adoption story

Rather than using the usual advance-fee fraud scam narratives, such as winning a foreign lottery or a wealthy African leader dying, this fraudster adopts a different approach. Despite this, there were many telltale signs pointing towards a scam.  The message was sent to hidden recipients (through a hacked webmail account originating from Hungary, but routed through Italy), and the message required a response to a different webmail provider. These are typical characteristics of an advance-fee fraud, but we decided to investigate further to see how the scammer intended to ask for money.

In an effort to make this adoption narrative appear as legitimate as possible, the fraudster made us go through several hoops before finally getting to the point where we were asked to send money. During our correspondence—which spanned 11 email replies over a two month period—the scammer informed us in great detail about the mother’s story, and the regulations involved with private and independent adoption. They even went as far as providing a fake adoption form along with pictures of the baby!


Figure 2. Babies offered for adoption through this 419 scam campaign


Figure 3. Fake adoption form used to gain victim’s confidence

When the fraudster finally decided to ask for money, we were asked to send US$2,500 to cover the “Court Order Preparation and Document Fee.” This took the form of one payment of $1,500 and another of $1,000, through a financial services wire transfer. It is likely the scammer requested the payments to be sent this way so the transaction appeared more legitimate and the victim would have more confidence that the scam was actually real.


Figure 4. Scammer requests baby adoption money

When the fraudster provided a name and address to receive the wire transfer payment, we assumed this information was phony. However, looking up this address led us to a startling discovery.

The payee address listed was the office address of a legitimate Adoption and Family Law attorney (who has absolutely no connection to this scam). While most scammers use any old fake name to perpetrate an advance-fee fraud, hijacking a real person’s identity can make the fraud appear more convincing. The unsuspecting target may look up the name and confirm the person is a legitimate attorney who is practicing in the United States. It all “adds up,” they send the money, and become yet another victim of the scam.

The execution of this adoption scam signals a new approach by 419 scammers, some of whom have now come full circle in their approach. In an interview with The Economist two years ago, I revealed how some advance-fee fraudsters have moved from sending legitimate and official-looking scam messages to far less professional looking missives offering large sums of money in unlikely scenarios. None of these scam narratives are very sophisticated because the scammers look for victims to “self-select.”

This example serves as a reminder that not all advance-fee fraud scams are lazy attempts to get the most gullible victims to participate. Some fraudsters use creative tactics, such as this adoption narrative drawn out over months with convincing background details and official-looking forms. There is no doubt that scammer imagination and creativity will continue to evolve in the future.