• 
• 

Published on August 7, 2007

Now Spammers have started using PDF spam and a flood of these emails began hitting the Internet in late June. This relatively new type of spam takes image spam a step further by placing the image in a PDF file attached to the email. TrendLabs has found that PDF spam currently comprises up to 5% of all email. Most of the current attacks have been "pump and dump" stock scams.

The recent PDF spam are sent by PCs infected with the E-card Trojan WORM_NUWAR. The higher the number of infected computers, the greater the amount of PDF spam sent. This same Trojan was responsible for sending image spam in 2006, showing that these same criminals are adapting their methods.

These new PDF spam emails tend to have randomly generated subject lines and attachment names and often contain little to no text in the body of the email. Initially, the PDF files in these spam attacks were the same, making it easy to identify similar files within the attack. But spammers quickly began randomizing aspects of the PDF file, requiring more sophisticated detection. Spammers are also blurring the text in the image to make it more difficult for anti-spam engines to identify the spam message. Here is an example of an image in a spam PDF file.

Not only does PDF spam provide a challenge to anti-spam filters by removing all content from the email body and placing it in an attachment, but these spam are also much larger than other types of spam, clogging networks and potentially delaying email.

Trend Micro quickly responded to this new type of attack by releasing anti-spam updates with heuristics targeted at PDF spam and continues to release further updates as this type of threat evolves.