According to Symantec in its latest state of spam report, health and financial related spam increased six percent during April, and it found that the top 20 subject lines relating to the swine flu spam campaign used certain keywords such as Jolie caught swine flu, Swine flu in NY, Madonna caught swine flu, America against swine flu, First US swine flu victims and, Be quick! anti-swine flu drugs are almost sold out.

Symantec says that health related spam samples had been observed with messages talking about medicines that could be used to fight the flu, and providing URLs to various pharmacy sites.

It says that, in one example, potential victims were sent an email with a malicious PDF attachment that promised to answer questions about the Swine Flu. It detected the malicious PDF file as Bloodhound.Exploit.6 and the dropped malicious file contained in the PDF as InfoStealer.
 
According to Symantec, while it remains to be seen whether swine flu spam will result in a swine flu spam pandemic, “history tells us that current event spam campaigns will continue in an effort to lure victims and distribute spam messages.”

“It should also be noted that spammers recently used the Italian earthquake in their messages. As always, users should be careful before opening any attachments or clicking on URL links.”

Overall, Symantec says spam volumes continue to creep back up to normal, and are currently sitting at 94 percent of their pre-McColo levels, adding that spam categories continue to fluctuate month to month with leisure and Internet spam decreasing eight and seven percent respectively, and financial spam in-creasing by six percent.
CONTINUED page 2

---

The security firm also said that, while image spam does not currently dominate the spam landscape, as it did in 2007 — when 52 percent of all spam was image spam —image spam hit an average of sixteen percent of all spam messages towards the end of April.

According to Symantec, image spam does from time to time reappear on the spam landscape, and in recent weeks a resurgence of image spam has been observed.
 
“Image spam is by definition a spam message which contains an attached image with little or no text, or HTML in the message body. The attached image will often contain various obfuscation techniques such as subtle changes to the colour or font and added background noise contained in the image in an effort to evade anti-spam detection.”

The call to action for the recipient, says Symantec, is often described in the attached image itself, with the recipient asked to type a certain URL into the address bar of their browser.

“If the recipient took this action and followed this URL they would be taken to a web-site promoting certain pharmaceutical products,” Symantec warns.