• Trend Micro
  • About TrendLabs Security Intelligence Blog
Search:
  • Home
  • Categories
    • Ransomware
    • Vulnerabilities
    • Exploits
    • Targeted Attacks
    • Deep Web
    • Mobile
    • Internet of Things
    • Malware
    • Bad Sites
    • Spam
    • Botnets
    • Social
    • Open source
Home   »   Bad Sites   »   Email Scams Spoofing Social Networking Sites Peddle Malicious Sites

Email Scams Spoofing Social Networking Sites Peddle Malicious Sites

  • Posted on:April 25, 2012 at 2:22 am
  • Posted in:Bad Sites, Spam
  • Author:
    Michael Casayuran (Anti-spam Research Engineer)
2

We saw samples of email messages disguised as notifications from popular networking sites, in particular LinkedIn, foursquare, Myspace, and Pinterest. These spam contain links that direct users to bogus pharmaceutical or fraud sites. They also use legitimate-looking email addresses to appear credible to recipients. Using famous brands like these sites are effective in luring users to the scheme as this gives credence to an otherwise obvious scam.

Fake foursquare Email Notifications

We uncovered spammed messages masked as notifications from foursquare, a popular location-based social networking site. The first sample we found pretends to be an email alert, stating that someone has left a message for the recipient. The second message is in the guise of a friend confirmation notification.

Both messages use the address noreply@foursquare.com in the ‘From’ field and bear a legitimate-looking MessageID. Similar to previous spam campaign using popular social networking sites, attackers here also disguised the malicious URLs. If users click these, the URLs direct to an empty web page containing another URL, which ultimately leads to a website selling sex-enhancement drugs.

Bogus LinkedIn, Myspace Messages Direct to “Wiki Pharmacy”

My colleague Neil Pondo also spotted sample messages that are purportedly from LinkedIn and Myspace. LinkedIn is a site specifically for professionals, while Myspace is a popular music website.

Both samples are disguised as confirmation email from these web sites. The messages contain links that supposedly direct users to the respective legitimate sites.

Similar to the fake foursquare email, these messages use email addresses that appear legitimate such as emailconfirm@linkedin.com and noreply@message.myspace.com, respectively. Recipients are asked by these mails to check out the provided link either to confirm their email address (for the spoofed LinkedIn) or cancel their account (fake Myspace email).

Upon further analysis, we have identified that the senders’ info were forged. We also did not find any pertinent details that could identify these messages as legitimate LinkedIn and Myspace email notifications. These mails also used cloaked URLs that redirect to the fake site “Wiki Pharmacy”.

Scam Message Disguised as Pinterest Lead to Fraud Site

The growing popularity of Pinterest has also caught the eye of cybercriminals. Previously, we noted a scam circulating in the photo-sharing site. This time, we found fake Pinterest email notifications that contain a URL, a purported online article on weight-loss. Users who click this link are instead lead to sites that were previously found to engage in fraud activities.

Trend Micro protects users from this threat via Trend Micro™ Smart Protection Network™, which blocks these messages and the related malicious sites. Users are advised to always be cautious of dubious-looking messages and avoid clicking links or downloading the attachment included in these.

Learn how to protect Enterprises, Small Businesses, and Home Users from ransomware:
ENTERPRISE »
SMALL BUSINESS»
HOME»

Featured Stories

  • systemd Vulnerability Leads to Denial of Service on Linux
  • qkG Filecoder: Self-Replicating, Document-Encrypting Ransomware
  • Mitigating CVE-2017-5689, an Intel Management Engine Vulnerability
  • A Closer Look at North Korea’s Internet
  • From Cybercrime to Cyberpropaganda

Security Predictions for 2018

  • Attackers are banking on network vulnerabilities and inherent weaknesses to facilitate massive malware attacks, IoT hacks, and operational disruptions. The ever-shifting threats and increasingly expanding attack surface will challenge users and enterprises to catch up with their security.
    Read our security predictions for 2018.

Business Process Compromise

  • Attackers are starting to invest in long-term operations that target specific processes enterprises rely on. They scout for vulnerable practices, susceptible systems and operational loopholes that they can leverage or abuse. To learn more, read our Security 101: Business Process Compromise.

Recent Posts

  • Necurs Evolves to Evade Spam Detection via Internet Shortcut File
  • Monero-Mining RETADUP Worm Goes Polymorphic, Gets an AutoHotKey Variant
  • XLoader Android Spyware and Banking Trojan Distributed via DNS Spoofing
  • XTRAT and DUNIHI Backdoors Bundled with Adwind in Spam Mails
  • Ransomware XIAOBA Repurposed as File Infector and Cryptocurrency Miner

Popular Posts

  • New MacOS Backdoor Linked to OceanLotus Found
  • Monero-Mining HiddenMiner Android Malware Can Potentially Cause Device Failure
  • Ransomware XIAOBA Repurposed as File Infector and Cryptocurrency Miner
  • ChessMaster Adds Updated Tools to Its Arsenal
  • Not Only Botnets: Hacking Group in Brazil Targets IoT Devices With Malware

Stay Updated

  • Home and Home Office
  • |
  • For Business
  • |
  • Security Intelligence
  • |
  • About Trend Micro
  • Asia Pacific Region (APAC): Australia / New Zealand, 中国, 日本, 대한민국, 台灣
  • Latin America Region (LAR): Brasil, México
  • North America Region (NABU): United States, Canada
  • Europe, Middle East, & Africa Region (EMEA): France, Deutschland / Österreich / Schweiz, Italia, Россия, España, United Kingdom / Ireland
  • Privacy Statement
  • Legal Policies
  • Copyright © Trend Micro Incorporated. All rights reserved.