BitDefender® researchers have detected a new wave of malicious spam promoting medication for sex life improvement, such as male enhancement drugs. The twist of this spam campaign resides both on its amplitude and the mix of requests for delivery confirmations for the unsolicited e-mails.

The first technique seeks to exploit a common feature in most e-mail clients – read receipts or notifications. Under normal circumstances, a read receipt confirms the user has received and read the message. When related to bulk mail, a read receipt proves that the user’s e-mail address is valid and active.

If the user discovers the trick and does not send the read receipt, the spammers deploy a secondary layer of confirmation techniques which uses a reference to a remotely stored image. E-mail clients traditionally block this type of content. To see it, users should allow the image to load and thus to confirm that they have read the message.

Should the previous two confirmation tricks fail, the third layer takes advantage, especially when the victims suspects fowl play but may not be aware of the “classic” unsubscribe or opt-out scam. The alleged opt-out links do not unsubscribe the recipient from the mailing list, but confirm instead that the e-mail address is fully functional and ready to get even more spam.

To keep a system spam-free, users should adhere to the following guidelines:

• Install, activate and update a reliable anti-malware, anti-spam and anti-phishing security solution.

• Do not enable automatic read receipt expedition in your e-mail client.

• Always delete the spam messages; if you accidentally open them, display the attached images or click links within their corpus you simply indicate your e-mail account is active and available to receive more spam or you may accidentally trigger and install other malware.

• Do not open e-mails and e-mail attachments from senders you do not know.

• Do not open e-mails with odd entries in the Subject line.

• Do not click any links indicated in the spam e-mails, including the “unsubscribe” link; you might trigger other malware and compromise your system’s security.

• Do not unsubscribe, opt-out or reply to any spam message; you will confirm your e-mail address is active and available for receiving even more unwanted messages.

• When browsing the Internet, do not submit your e-mail address and personal information when requested by suspicious web pages.

• When purchasing goods and services online, refrain from signing-up for any additional service or promotion, as well as other online subscriptions, advertised on the seller’s website.

• Use at least two e-mail addresses. Create one e-mail account and use it for your correspondence with people you know and a second e-mail account for the websites forms requiring an e-mail address to allow content access.

• Avoid placing your e-mail address on websites, guest books, newsgroups, contact lists, shopping or gift lists.

“Users should be aware that without the appropriate security solution the integrity of their systems is at an extremely high risk,” said Vlad Valceanu, head of BitDefender’s Antispam Research. “To validate the e-mail address means that the user has signed the death sentence of his or her inbox. The next messages the spammers will send could carry a piece of malware that wipes out the hard drive or harvests and sends out sensitive data, like the credit card number the user types when purchasing goods online.”