Upsurge in attacks using Dutch

I must say that there are interesting times in the Netherlands. Normally we don’t see Dutch used often in spam and phishing emails, but there’s been a real spike the last 10 days.

It began last week on Monday with two simultaneous spam runs in Dutch: one about a supposed nuclear accident in Amsterdam and one purportedly from a girl called Polina who was in need of a ‘friend’. Both of these spam runs tried to convince the user to install one and the same codec, which in reality was a Trojan-Spy.Win32.Zbot variant.

After this incident there was a spam run in Dutch concerning helpnumee.com. This site claimed to be part of the Aids foundation and was asking for donations. Obviously this was a fraud.

And then last night I saw a Dutch phishing email trying to steal Windows Live logins. We’ve notified the local CERT and hope that the site gets taken down promptly.

The quality of the Dutch varies from incident to incident, but overall has greatly improved over the attacks from six months ago. The Windows Live phishing email was an exception: it was written rather badly. However, the sad reality could be that the attackers are trying to mimic teenage slang as part of their social engineering strategy.

If these incidents are a sign of more to come than I foresee 2008 being a very interesting year for Dutch users.