In the second quarter of 2016, the average level of spam emails reached 57.3% of all emails, according to Kaspersky Lab’s quarterly report on the spam and phishing landscape. This is an increase of four percentage points compared to the second quarter of 2015 and one percentage point compared to the previous quarter.
During the previous quarter, political issues were among the most interesting topics for spammers. The upcoming US elections and the presidential candidates gave scammers a good opportunity to target users. Among the “hot” topics of the quarter was the Olympic Games in Brazil, with spammers and phishers making money from sports fans.
Donald Trump was one of the main subjects for the majority of political spam messages. In these emails, spammers described to the targeted recipients the unique methods that Donald Trump followed to become rich, inviting them to copy them in their own businesses. To learn more, users had to open the link contained in these emails. The link led to a fake news site, which contained an article about how Trump made his money. To learn more, users were invited to fill in their personal information in the website’s online form. Obviously, the user did not earn money, but the cybercriminals obtained sensitive data.
“Quite often spammers try to exploit important news and speculation about famous people. Donald Trump was no exception. Users should be aware of this and remain vigilant in order to mitigate the risk. We can also see that social networks are particularly attractive to spammers and phishers. If one of your friends starts behaving differently when online and sends provocative links or even tagsyou or one of your friends under suspicious posts, then it is likely that their account has been hacked. Do not open theselinks and do not install any software that the system may indicate to you. Common sense can prevent almost all “infections” of this type. In addition, think twice before opening attachments in e-mails, since the risk of “infecting” your computer is very high,” warns Daria Gudkova, Spam Analysis Expert at Kaspersky Lab.
The Anti-Phishing system of Kaspersky Lab solutions was activated 32,363,492 times on users' computers. In the second quarter of 2015, the system was activated 30,807,071 times, which indicates an increase of almost 5% year-on-year. 
The highest percentage of users affected by phishing attacks was in China (20.22%), followed by Brazil (18.63%) and Algeria (14.3%). It is worth noting that the percentage of users affected in the second quarter of 2015 was lower and the top three countries in the ranking were then Brazil (9.74%), India (8.3%) and China (7.23%). As can be seen, the above numbers have doubled on a year-on-year basis.
An unusual anomaly in the volume of malicious spam traffic was discovered during the second quarter. From June 1 to June 21, the company's specialists noticed a huge decrease in malicious spam email campaigns. During this period, there was a 20-fold decrease in the average number of spam emails with zip files, compared to the overall average for the quarter. At the same time, the Necurs botnet mysteriously reduced its fraudulent activities.
Kaspersky Lab experts do not have any hard evidence that these two events are connected, but it is possible. Various sources on the Internet reported that the operators behind the Necurs botnet encountered some technical issues, which resulted in its operation being interrupted. These problems seem to have been resolved quickly, as from June 21 onwards, the malicious spam email flow was restored along with the botnet's operations.
To stay safe and avoid falling into the trap of scammers, Kaspersky Lab recommends that users exercise common sense and be cautious when online. In general, users should not click on untrusted links, not allow the installation of plugins from suspicious online sources, and not disable the Anti-Phishing and Anti-Spam features of their security solutions.
The full report on the spam and phishing landscape in the second quarter of 2016 is available on the Securelist.com.
Download the full report (PDF)
