Dangers of Unused E-mail Accounts

Spammers continue to step up their games, targeting your abandoned e-mail accounts. We've all been known to carry multiple e-mail accounts, some of which we don't use, or only use for specific purposes. Spammers attempt to break into these unused or little used accounts via spear phishing or brute force attacks to obtain a user's password. Once they get into the account they begin sending spam out to the user's contacts. They do so at a very slow pace, as to not be detected.

SANS Institute's Chief Research Officer Johannes Ullrich recently explained the attacks on his daily Internet Storm Center podcast. You can listen here. He said that in an added twist, spammers were setting up an automatic reply to an address that was similar to the original e-mail address, but not quite the same. The address would carry an extra "s" or a different spelling. When contacts started to notice the spam coming in more frequently they may attempt to warn the infected account, but the automatic reply would go straight to the spammer's account or it will bounce.