Failed delivery spam and other naughty things to watch out for this holiday season

‘Tis also the season for failed delivery spam.

Cyber Monday online sales set a new sales record this year, as it does most years. A total of $7.9 billion was spent on that one day in the U.S. alone. That’s up 19.3 percent from the previous year. Add in Thanksgiving Day and Black Friday and $15 billion were spent through ecommerce in just three days.

So, at this point, who isn’t expecting something to be shipped to their homes in the next few weeks, whether it’s an item you bought or a gift from a loved one?

That’s where failed delivery spam comes in

If you were to see an email notice like this from international shipper DHL in your email inbox with information about an upcoming delivery, would you be surprised? Would you hesitate to click on the weblink in the email’s body?

How this Apple purchase notification? If you got it, might you click on the “See Details” link? Why not?

These spam links may lead to a malicious download—like a JavaScript that then downloads a document with malicious macros embedded inside. And that macro then downloads the executable payload that will infect your computer.

This spam-to-infection path is a pretty simple formula that works well. And it has increasingly become the vector of choice for online criminals, as other methods like exploit kits have waned.

Spam on the rise and perfect for the holiday season

F-Secure’s research finds that spam is the most common method for cyber criminals to spread malware in 2018. Roughly 69 percent of spam emails attempt to trick users into visiting a malicious URL. Malicious attachments were used in the remaining 31 percent of spam. And these tactics become even more effective as the holidays near and pressure to find the perfect gift for everyone, including yourself, rises.

“The kind of spam that criminals use doesn’t seem so spammy to a lot of people this time of year- More people are just more open to the commercial messages spammers like to spoof, which makes individuals more vulnerable at home and at work,” says F-Secure Behavioral Science Lead Adam Sheehan. “Tests we performed using simulated Black Friday and Cyber Monday phishing emails saw about 39 percent more people click than similar tactics we use at other times during the year, which isn’t a trend we like to see.”

The failed delivery notification scam works because it plays on our trust of huge brands that we deal with on a nearly constant basis. And it amplifies a fear we all have—the fear of missing out. And as the holidays approach, we may be missing something that has increased significance because it’s meant for someone we care about or it could be from someone we care about. Online criminals are also behavioral scientists in their own right. They know we’re inclined to click first before we ask questions because we like to nurture our own fantasies about the gifts we might receive while also refraining from questioning others to keep from spoiling a surprise.

So what should you do about the rise of spam?

Practice cyber security basics, of course. Keep your system updated and run security software at all times. And train yourself to not click on links in emails—especially emails related to shipping.

There is some good news for this holiday season. Spam is far less likely to infect you with ransomware this year than in the last several. Malware that holds your files hostage for payment is in decline now as it has been for all of 2018. But letting crooks utilize your PC power for virtual currency mining or to make your computer a part of an ad fraud botnet is still a problem. And these are problems you’ll be able to avoid if you can practice just a bit of cyber hygiene.

Happy spam-free holidays!

Download the infographic (PDF)