SecurityZone.org - Information Security Blog

Unless your e-mail address normally doesn’t get any form of SPAM, you have probably recently received pump and dump stock scams in the form of a portable document format (PDF) attachment. For me it all started in late June. I started receiving e-mails with subjects like “Check_63182.pdf attached”, “Fwd: text.34271.pdf”, and “Re: mailbody.01001340.pdf” with attachments that matched the name seen in the subject. Each PDF is anywhere from just over 2 KB on up to 40 KB. In fact just as I was writing this last sentence my e-mail refreshed with a new message letting me know that “MXRW, a huge corporate travel group is expanded!” Although it did automatically filter into my BULK/SPAM folder, which is a good thing.

It seem this method is being used to successfully evade several SPAM e-mail filters. At first it looked like we were dealing with some 0-day PDF worm that was firing itself out. Turns out it’s just people trying to rip you off and make a quick buck. Here are some recent write-ups on it from ISC and SecurityFocus:

http://isc.sans.org/diary.html?storyid=3087
http://www.securityfocus.com/news/11475