20-fold increase in fraudulent spam
In Q3 2011, the percentage of fraudulent emails in spam traffic increased twenty times, rising from 0.1 per cent last quarter to 2 per cent of all spam traffic in Q3. The quantity of fraudulent messages is striking, but so is the variety of social engineering techniques deployed.
On one level, attackers used tried-and-trusted tricks, sending email offers on behalf of online games to steal usernames and passwords, or fake notifications from major organisations which then link to a phishing resource. Multi-stage attacks on a new level are now becoming more common.
For example, messages invited recipients to take part in a survey and win money for doing so. Users followed the link, found themselves on a page with a customer satisfaction survey form and filled it in. After submitting the survey, they were redirected to a further form asking for their full credit card details in order to process the promised payment. Of course, the information was likely to be used to clean out accounts, rather than pay any cash.
