Spammers hiding TXT and PDF files inside ZIP attachments

After a period of relative stagnation, spammers have certainly been on the move as of late.

Last month they hit us with PDF, and then Excel file based spam. At SpamButcher we've been pretty quick to catch on, but we haven't fully adapted to their latest permutation.

Spammers are now sticking PDF and TXT files inside compressed ZIP attachments.

As with other recent innovations, the spam being sent seems to be an attempt to artificially inflate the value of certain publicly traded equities (stock spam).

Since ZIP files compress their content, most applications aren't able to read inside of them. While anti-virus software may have the needed routines to open and scan the ZIP, at best spam filters are usually only capable of recognizing that there is an attachment.

Open source software is available to deal with this format, so adding this functionality to existing spam programs should be possible with only moderate effort. Up until now however, there just hasn't been reason to do so.

Like PDF files, ZIP attachments are commonly used in business emails. Sometimes they are used to encapsulate file formats that would otherwise be blocked by email servers or clients. Other times they contain a large number of files or directories so they can be practically attached to a message.

My inbox can testify to the fact that SpamButcher doesn't yet quite successfully filter junk mail of this type. SpamButcher caught four ZIP spam this morning, but it also let three through. The filter knows enough to tag ZIP files as risk-factor. However, we can't simply block all messages that contain such files. We have more research to do.

Back