Emails for disaster victims likely bogus

What do the earthquake in Nepal, the presidential election in Nigeria, and the Olympics in Rio de Janeiro all have in common?

They were the most common subjects of spam emails intended to steal personal data and/or falsely solicit funds in the second quarter of 2015, according to Kaspersky Lab.

Less spam, more spurious

While the percentage of spam in email traffic decreased by 5.8 percentage points from the previous quarter (from 59.2% to 53.4%), second-quarter 2015 spam emails were more focused on current events to lure victims.

Some spam included fake messages asking recipients to make a donation to help the victims of the earthquake in Nepal. In other mass mailings, fraudsters tried to lure recipients with the sum of $2 million, which the newly elected president of Nigeria was allegedly ready to send the user as compensation.

Additional mailings included fraudulent notifications of being chosen through a lottery drawing for tickets to watch the Olympic Games in Brazil next year. These mailing were an attempt to persuade recipients to provide spammers with personal data to receive the prize.

“During this quarter we saw spammers use tragic events to trick consumers,” says Darya Gudkova, head of the content analysis and research department. “It’s a tactic that fraudsters have used before, but with events like the Nepal earthquake being covered widely by media worldwide, these messages are likely to resonate with sympathetic recipients.”

Gudkova says that to protect themselves, people should not open emails from unknown senders and remember not to click links in these emails, or open any attachments.

“With some fraudsters using tactics to make the name and address of the sender look more legitimate, this is more important than ever,” says Gudkova.

Spam geography

In the second quarter of 2015, there were major changes in the top three countries most often targeted by email frauds. Germany (19.59%), which was only fourth in the first quarter, topped the quarter’s rating. The U.K., which headed the rating in the first quarter, moved down to second place (6.31%), and Brazil came in third (6.04%).

The U.S. (5.03%), traditionally most targeted, was in fourth place. In addition, Russia (4.74%), which came only tenth in the previous quarter, climbed to the fifth position.

The U.S. (14.59%) and Russia (7.82%) remained the biggest sources of spam. China came third with 7.14% of the world’s spam, compared to 3.23% in the previous quarter. It was followed by Vietnam (5.04%, compared to 4.82% in the first quarter), Germany (4.13% compared to 4.39%), and Ukraine (3.90% compared to 5.56%).

There has been a worldwide decline in the share of spam in email traffic since the beginning of the year. In the second quarter of 2015 it stabilized, fluctuating between 53.5% in April and 53.23% in June.

Technical talk

Trojan-Spy.HTML.Fraud.gen topped the rating of malicious programs sent by email. This program is a fake HTML page which is sent via email, imitating an important notification from a large commercial bank, an online store, or a software developer. This threat appears as an HTML phishing website where a user has to enter personal data, which is then forwarded to cybercriminals.

In the second quarter, Kaspersky Lab’s anti-phishing system was triggered 30,807,071 times on the computers of Kaspersky Lab users. Also, 509,905 masks of phishing URLs were added to the Kaspersky Lab databases over this period.