Excel Spam

Well it’s about time someone decided to distribute a stock pump&dump message inside an excel file.

Commtouch first identified and blocked this new type of spam on Saturday, July 21, at 1:20 pm GMT. The Excel spam promotes stocks in file attachments with names like “invoice20202.xls,” “stock information-3572.xls,” and “requested report.xls.”

Of course this seems like a logical progression after image spam, and PDF spam, and probably other MS Office applications will follow suit. The worrisome thing is that all of these applications can be used as virus carriers, think back to almost exactly a year ago, when suddenly MS Office Macro viruses were all the rage in June/July ‘06. Even easier than setting up a macro virus, spammers/virus writers can simply embed a hyperlink into the excel spreadsheet, just as they can with PDFs.

The word from our detection center is that this outbreak, while the first of its kind, is fairly small, but bear in mind that they all start out small at first – image spam started out with some experimental runs before the first really big attacks, and so did PDF spam.