As unemployment levels soar in Canada and overseas, spammers are having a field day bushwhacking hapless job seekers with career-related spam and malware.
Recently laid-off professionals were targets of a significant portion of spam e-mails sent out in February and March. Such e-mails are often purveyors of malware that compromise recipients’ computers.
For instance, a common type of spam e-mail — that many have fallen prey to — features bogus job application rejection notices.
In its March Spam Report, security firm, Cupertino, Calif.-based Symantec Corp. describes how such spam messages compromise recipients’ systems.
See related story and video: Cybercriminals profiting from global recession, distracted governments
The spurious e-mail message reads: “Unfortunately we have to inform you that your qualifications and experience do not fit the position you applied for.”
It includes an attachment, which is supposedly a copy of the user’s job application. The attachment is titled: copy of your CV.zip or job-application-form.zip,
But if users click on the attachment, their system is infected with the Hacktool.Spammer virus.
The virus allows hackers to flood users’ Inboxes with spam and can be programmed to send messages to specific addresses.
The huge growth in visitors to online job sites, such as Monster, or networking sites, such as LinkedIn, has intensified this threat, according to Pablo Stern, director of development of Symantec’s Brightmail Gateway product.
Stern explains why job seekers often hoodwinked by career-related spam.
Users, he said, may not remember all the positions they apply for – or may have an arrangement with recruiters to forward potential openings to them.
By using social engineering techniques, cybercriminals uncover basic information about people, and then use that to deceive unsuspecting victims.
The spam report also found numerous e-mails targeted at job seekers with subject lines that said “HURRY! I found you a new job…,” “Free time job from home,” “Job you might be interested in!” “Get the Job fast this one,” and “FW: Global job vacancy-apply now.”
Such messages are used to harvest personal information, such as first and last name, postal codes, phone numbers and age. This data can then be sold on the black market, or used to engineer future spam attacks.
Symantec’s March report also talks about a surge in spam targeted at writers looking to make a little extra cash writing blogs.
One reason could be the huge hit that print-related businesses and brands have taken from the recession, industry insiders say.
They note that newspapers and publishing companies are folding up and laying off writers each day.
Contributing to a freelance blog, such as Suite 101, or even developing a personal blog is common way such writers keep their skills sharp as they look for their next job.
The popularity of blogs has sky-rocketed over the last few months, Symantec’s Stern noted, with Canadians increasingly going to blogs for opinions and commentary on recent news.
That’s a trend spammers are capitalizing on.
For instance, recent spam messages pretended to solicit contributions from freelancers and bloggers – offering to pay writers amounts ranging from $12 – $50 per contribution.
One message boasts, “Just write one or two short, simple articles or blog posts every day and you’ll be bringing in several hundred dollars of cold hard cash per week, al-most effortlessly!”
Users who register to participate are charged $2.95, which requires credit card information.
Two main factors are driving the success of the blog spam attack, Stern said. The first is the huge popularity high-profile bloggers –- the Rob Scobles and Perez Hiltons of the world.
The second factor is the growth of news feeds on Twitter and Facebook – a trend that encourages people to put their life online and share thoughts with colleagues or professionals in their industry.
Another Canadian expert isn’t surprised spammers are targeting recently laid off individuals, and cautions against e-mails promoting ‘work from home’ opportunities.
” If something seems too good to be true, it is,” Said Candice Low, research analyst at Info-Tech Research in London, Ont. “While some of these ‘work from home’ ads are actually for legit companies, most are phishing attempts.”
She said users can determine if a site is authentic by doing their homework.
“The easiest way to verify that a Web site is legitimate is to do an online search for the company name to see if it is flagged as fraudulent.”
Any job offer requiring you to pay someone a fee or give out sensitive information — such as passwords, credit card information and bank account numbers — is most likely a phishing attempt, the Info-Tech analyst said.
Symantec’s Pablo Stern says it can be tough to ignore e-mails from recruitment firms, but urges users to protect themselves by being cautious of certain file types, such as executable files (.exe).
A free Symantec portal — Brightmail IQ services — lists current trends, both local and global, that users should be aware of.
Recent trends and spamming tied to phishing and social engineering reveal the impact of spam is far more sinister, experts note.
Today, spam’s harmful impact isn’t limited to the time and energy expended on deleting these unsolicited e-mails, Stern noted. “Nowadays users experience real losses.”
