200-fold increase in HTML-attachment spam

Posted by   Virus Bulletin on   Feb 16, 2012

Cutwail botnet likely behind campaign that sends users to Phoenix exploit kit.

Researchers at M86 have reported a significant increase in the amount of spam sent with malicious HTML attachments, the volume of which on some days was 200 times that on the first day of the year.

HTML, the mark-up language used to create web pages, is commonly used in email to display various fonts and colours and to embed images. All modern email clients are capable of displaying HTML emails, though it is good practice for these to contain a text-part as well. A slight modification to the emails means the HTML-part is seen as an attachment that can be viewed in a web browser, rather than shown within the email client. It is this that is being used in a large spam campaign, of which M86 believes the Cutwail botnet is the perpetrator.

These particular emails - which either have the subject 'End of August statement' or come with a 'Xerox scan' attached - contain an HTML attachment in which, through obfuscated JavaScript, an iframe is embedded. The Phoenix exploit kit is loaded in the iframe, which attempts to infect the user through exploits in various browsers and plug-ins.

The tactic of infecting users via iframes and obfuscated JavaScript is commonly used for drive-by downloads, mostly in compromised legitimate websites. By using an HTML attachment rather than a website, this kind of attack is less likely to be picked up by web filters, while spam filters may not attempt to de-obfuscate the JavaScript, thus making it less likely for URL blacklists to block the emails.

HTML-attachment spam made the news last month when it was said that users could be infected without opening the attachments. While it is not impossible for an email client to open the attachment and render the JavaScript, either through a bug or through bad design, it seems unlikely for this to happen. We have not found evidence of an email client with that property.

More at M86 here. The original story on the emails allegedly infecting users without the need to open an attachment is at eleven here, with comments from Sophos's Naked Security blog here.

Posted on 16 February 2012 by Virus Bulletin

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

Didn't come to VB2017? Tell us why!

Virus Bulletin is a company - and a conference - with a mission: to further the research in and facilitate the fight against digital threats. To help us in this mission, we want to hear from those who didn't come to Madrid. What is your impression of…

Montreal will host VB2018

Last week, we announced the full details of VB2018, which will take place 3-5 October 2018 at the Fairmont The Queen Elizabeth hotel in Montreal, Quebec, Canada.

VB2017 preview: Beyond lexical and PDNS (guest blog)

In a special guest blog post, VB2017 Silver sponsor Cisco Umbrella writes about a paper that researchers Dhia Mahjoub and David Rodriguez will present at the conference this Friday.

Avast to present technical details of CCleaner hack at VB2017

The recently discovered malicious CCleaner version has become one of the biggest security stories of 2017. Two researchers from Avast, the company that had recently acquired CCleaner developer Piriform, will share the results of their investigations…

VB2017 preview: Walking in your enemy's shadow: when fourth-party collection becomes attribution hell

We preview the VB2017 paper by Kaspersky Lab researchers Juan Andrés Guerrero-Saade and Costin Raiu on fourth-party collection and its implications for attack attribution.