The outbreak is the latest in a string of tactics from the past six months which avoid filters by using file formats not generally blocked or difficult for filters to disassemble and search. It started with "image spam" which used picture files to bypass filters. That was followed by spam that used the PDF file format. Now the audio MP3 version of the spam is spreading rapidly.

In each case, the primary use of the spam is for a pump-and-dump stock scheme. The message tries to entice its viewer (or listener) into investing in a penny stock. If enough recipients decide to invest, the price surges, sometimes doubling. The originators of the scheme then dump their shares at the peak price. The tactic was so effective with image spam that the SEC halted trading on many penny stocks to stop the problem.

In the audio version, the user receives an MP3 file that is socially engineered with a name that invites clicking—either because it is a popular band name or title that seems personal. Some documented titles include: dadsong.MP3, oursong.MP3, weddingsong.MP3, santana.MP3, sayyousayme.MP3, smashingpumpkins.MP3, bbrown.MP3, bspears.MP3, gloriaestefan.MP3, beatles.MP3; answeringmachine.MP3, coolringtone.MP3, listentothis.MP3 and elvis.MP3, according to researchers at Cyberoam, who are tracking the problem. The files range in size from 88KB to 150KB. Audio Spam: The Latest Twist on a Never-Ending Security Threat - CIO.com - Business Technology Leadership

Technorati Tags: audio spam, mp3 spam