....or so spammers would have you believe.

A couple of days before the inauguration of president-elect Barack Obama spammers are sending out political propaganda that would have you believe that Barack Obama no longer wishes to be President of the United States. 

Spam emails are being sent out with subject lines such as "Haven't you heard latest news about our president-elect?" (Funny enough, one of these samples originated in Brazil.  Is Obama about to be President down there too? :) ), "End-time for USA", and "Who will be our president now?".  The messages are single line spam messages with phrases of only a few words followed by a link to a barackobama.com look-alike site.  Some of the phrases being used in the emails that we have observed are "Barack Obama abandoned sinking ship" and "Obama doesn't wany anymore to be a president".

The site that users are lured to if they click the link in the email looks like this:




All of the links on the site link to a file named pdf.exe which McAfee is calling part of the Waledec family of malware.  Waledec is widely considered to be the new incarnation of the Storm Worm based on its similarities in behavior to the original Storm which has been eradicated. 

As is often the case with these new outbreaks, AV detection is scarce so be aware of this new tactic.  Taking a brief opportunity to toot our own horn, we predicted this type of attack in the January edition of our Threat Forecast and Report.

Volumes are currently averaging about 4,000 per hour hitting the MX Logic systems.  We will continue to monitor this over the weekend and update as necessary.


*** UPDATE 1/19/2009 3:30pm MST *** Volumes have averaged between 5-16k messages per hour over the weekend and into Monday with today's average hovering around 10,000 per hour.  No new significant variants have been observed.  Below is an updated volume graph:



As you can see, there are still significant peaks and valleys in Obama email message flow which means that this campaign is still actively sending out spam.  With Tuesday's inauguration we will continue to monitor for either another resurgence of this tactic or the emergence of another new variant from the PCs responsible for sending out this current spam wave.  As soon as anything crops up, we will be sure to make you all aware.