Recently, amidst the de rigeur spam touting generic Viagra and pleas for my account details with a bank I don’t use, I have been receiving PDFs as attachments. Naturally I haven’t opened a single one.
I have been sent attachements in the past, but this marks a new trend in spamming one particular email address I use. Today I got three PDFs: check.pdf, abuse.pdf and email_a5c087e.pdf. Using Thunderbird I checked the message source code and all three seem to have the same data:
JVBERi0xLjMgCjEgMCBvYmoKPDwKPj4KZW5kb2JqCjIgMCBvYmoKPDwKL1R5cGUgL0NhdGFsb2cK
L1BhZ2VzIDMgMCBSCj4+CmVuZG9iagozIDAgb2JqCjw8Ci9UeXBlIC9QYWdlcwovS2lkcyBbIDQg
MCBSIF0KL0NvdW50IDEKPj4KZW5kb2JqCjQgMCBvYmoKPDwKL1R5cGUgL1BhZ2UKL1BhcmVudCAz
IDAgUgovUmVzb3VyY2VzIDw8Ci9Gb250IDw8IC9GMCA4IDAgUiA+PgovWE9iamVjdCA8PCAvSW0w
IDkgMCBSID4+Ci9Qcm9jU2V0IDcgMCBSID4+Ci9NZWRpYUJveCBbMCAwIDU4NCAyMDhdCi9Dcm9w
And so forth. I googled the code and I’m not the only one to get this rubbish. It seems to be the latest fashion for spammers, PDFs that contain images. Bastards.
The other peculiar mail I got today was from someone in Germany claiming:
Our robot has detected an abnormal activity from your IP adress on sending e-mails. Probably it is connected with the last epidemic of a worm which does not have official patches at the moment. We recommend you to install this patch (I have removed the URL, which was in numbers rather than words) to remove worm files and stop email sending, otherwise your account will be blocked.
Customer Support Robot
Considering the email has such gibberish addresses as bhyjt@wfrmls.com and a36dcae987d9000be022d968088aea28@wfrmls.com, how dumb do they think I am? Straight to the junk directory, and from there OBLIVION.