Spam in Q3 2015: Spammers Exploit Tourists and the Lonely with Fake Airline Tickets and Russian Brides

Kaspersky Lab’s latest report – ‘Spam and Phishing in Q3 2015’ reveals the latest spam and phishing trends across the globe. The report shows that although the percentage of spam in email traffic has decreased since Q2, spam is using an increasing variety of tactics to deceive recipients and bypass email filters.

The report shows that in Q3 of 2015, spam accounted for 54.2% of email traffic, a 0.8% drop from the previous quarter. The top three sources of spam are unveiled in the report as: the US (15.3%), Vietnam (8.4%) and China (7.2%).

A new phishing email trick became popular in Q3. In order to bypass spam filters, the text of the email and fraudulent links were placed in an attached PDF document rather than in the message body.

Exploiting the summer holiday season, fake notifications from booking services, airlines and hotels were used to spread malicious programs such as Trojan-Downloader.JS.Agent.hhy, disguised as a flight e-ticket or hotel reservation. Another type of spam email offered a selection of brides (mainly from Russia and Ukraine) to foreign suitors. After replying, targets were sent further spam emails and some ‘brides’ asked for money to visit their ‘suitors’.

Tatyana Shcherbakova, Antispam Analyst, Kaspersky Lab said, “During the third quarter of 2015 we saw spammers exploit the summer holiday season and the lonely. A variety of tactics were used – from sending fake notifications on behalf of hotels, to sending fraudulent links in PDF attachments, and requests for money to lonely ‘suiters’. With this variety of tactics expanding, it’s vital that users protect themselves online with the latest cybersecurity tools.”

Malicious attachments in email

As in Q2, the fake HTML page Trojan-Spy.HTML.Fraud.gen once again topped the rating of malicious programs sent by email. Its emails lure targets by imitating an important notification from a commercial bank, airline or online store.

Countries targeted by malicious mailshots

There were some significant changes in the top three countries targeted by mailshots in Q3 2015. Germany (18.47%) remained on top, although its contribution dropped by 1.12%. since Q2. The amount of malicious spam originating from Brazil almost doubled in Q3 compared to Q2, putting Brazil in second place (11.7%). Russia moved quickly up the ranks from fifth to third place (7.56%), as its share grew by 2.82%. The UK (4.56%), which was second in Q2, ended Q3 in sixth place. 

Sources of spam by country

The US remained the biggest source of spam in Q3, with 15.34% of spam originating from there. Vietnam was second with 8.42%, compared to 3.38% in the previous quarter. China rounded off the top three (7.15%), with its share remaining unchanged from the previous quarter.

Russia, which was in second position in Q2, dropped its share 2.03% to 5.79%, pushing it to fourth position. It was followed by Germany (4.39%) and France (3.32%), both of which changed only slightly since Q2.

Phishing

In Q3 2015, the Kaspersky Lab Anti-Phishing system was triggered 36,300,537 times on the computers of Kaspersky Lab users. This is 6 million times more than during the previous quarter. During the quarter, 839,672 phishing wildcards were added to Kaspersky Lab databases.

The proportion of spam in email traffic

After some relatively stable months in the second quarter, there were some shifts in the percentage of spam in global email traffic. Matching the summer holiday season, an increase in spam during July and August 2015 was followed by a noticeable drop in September. As a result, the average percentage of spam in Q3 amounted to 54.19%, slightly higher than the average for the previous quarter.

For the full ‘Spam and Phishing in Q3 2015’ report, click here.