What is a Malspam Attack?

Malspam: A portmanteau of ‘malicious’ and ‘spam’, referring to unsolicited emails that deliver malware to users.

Malspam, or malicious spam, refers to email campaigns that deliver malware under the guise of legitimate communication. These campaigns are designed to evade detection and filtration mechanisms while compromising end-user systems. In the context of phishing and social engineering, malspam plays a crucial role by using social engineering tactics to trick recipients into clicking links or opening malicious attachments.

Why It Matters

The presence of malspam underscores a major avenue through which threat actors compromise network security. For operators in phishing engagements, malspam campaigns are essential tools that test the efficacy of spam filters, user awareness, and endpoint protections. By mimicking legitimate email patterns, often reinforced by social engineering techniques, malspam aims to gain a foothold within target networks, either for immediate exploitation or as part of larger, multi-stage attacks.

Malspam’s ability to distribute malware like ransomware, keyloggers, or remote access trojans provides a direct entry point for threat actors to gain unauthorized access and propagate within organizations. Recognizing malspam campaigns allows practitioners to understand the kinds of threats posed by email-delivered malware, along with the techniques used to bypass conventional security measures.

In Practice

Consider a campaign that uses the subject line “Invoice Due – Action Required” from a spoofed email address such as billing@finance-portals.com. The message contains an attachment labeled as an invoice in PDF format, which actually harbors a malicious payload. Once executed, the payload installs malware like LausivLoader, which can download additional malicious software or perform other nefarious actions. This technique leverages urgency and familiarity to bypass a user’s cautious disposition.

Another example includes a well-crafted email mimicking logistics companies, with subject lines such as “Shipment Notification – Track Your Order.” This message may include links with display text indicating tracking information, but instead, redirects to a compromised website hosting a drive-by download attack. The URL may resemble legitimate sites, with minor alterations like track-pacel-service.com—showcasing a typical method to trick users.

Email Body Example:

Subject: Invoice Due - Action Required

From: billing@finance-portals.com

To: finance@targetcompany.com

Dear [User's Name],

Please find attached the invoice due for payment by the end of this week. Failure to do so may result in delays to administrative processes.

Attachment: Invoice_Due.pdf

Best regards,

Finance Department

A final strategy involves leveraging legitimate collaboration tools in emails, such as mimicking notifications from platforms like Google Drive or Dropbox. The email might request the user to “review a shared document” with apparent links to a document shared through a URL like docs-gdrive-shared.com, which convinces a user to proceed without heightened scrutiny.

These examples highlight how malspam campaigns are crafted to ensure that even vigilant users might inadvertently execute malicious actions, offering insights into the subtlety and creativity required to make a malspam attack effective.

Related Terms

Operators dealing with malspam should also consider familiarizing themselves with terms like phishing, which involves tricking users into disclosing sensitive information, and social engineering, the broader practice of deceiving individuals into compromising security systems. Another adjacent concept is ransomware, which is often delivered via malspam to encrypt files for ransom.