Spammers Use Excel to Cloak Malware Articles | Computer Security

Spammers are using Microsoft Excel as the newest packaging for their spam, says Commtouch, a Nasdaq-listed anti-spam technology provider. The finding is based on the company’s analysis of billions of email messages globally.

“Like other types of spam messages, the Excel spam is being sent from zombie computers or bots typically home PCs that have previously been infected by Trojan malware,” the company says in a media statement.

The Excel spam packaging promotes stocks in file attachments with names like “invoice20202.xls,” “stock information-3572.xls,” and “requested report.xls.”

Commtouch CIO Amir Lev says Excel is a natural progression after a recent spate of PDF spam, which itself was a development from basic image spam.

“We expect other file formats to follow suit; think of the spam potential in PowerPoint files, or Word documents,” he says.

Other file formats Commtouch recently released its Email Threats Trend Report for the second quarter of 2007. The report showed PDF-spam made up 10-15% of global spam messages during a 24-hour period, increasing overall global spam traffic by 30-40%.

Image spam dropped 50% to less than 15% of all spam in that period. In the previous quarter of the year, image spam accounted for 30% of all spam in the first quarter of 2007. The report also showed global spam levels remained high, with 85-90% of all global email being spam.

Lev says spammers assume that by wrapping the same message in a new format, they will bypass most anti-spam engines that try to analyze the content of mail messages.

However technologies that rely on identifying patterns in mass emails block these types of messages automatically, regardless of the content or format.

Malware writers have used Excel in the past as a carrier for viruses. In June and July 2006, a series of attacks exploited vulnerabilities in Microsoft software, including Excel, Microsoft Word, and PowerPoint.