Spammers use ‘video tributes’ to trick users

Security vendor Sophos has issued a warning about a recent spam campaign designed to harvest email addresses by attracting readers to websites offering topical "video tributes".

The sites offer a range of teasers for video tributes to 9/11 victims, Anna-Nicole Smith and Steve Irwin, "The Great Crocodile Hunter".

To view the full videos, users need to provide their email address – something which seems harmless enough unless they visit the site's privacy policy, accessible via a link at the bottom of the page.

In this policy, the operator of the page reserves the right, amongst other things, "to send you personalised marketing information via electronic delivery", "to send you targeted advertising", and to "sell and/or license the personal information that you provide to third party businesses," including "providers of direct marketing services and applications", said Sophos.

When they click through to the video, they are given an opportunity to invite five friends to view it to, by providing their email addresses to the site's operator.

Paul Ducklin, head of technology, Sophos said, “The first level of protection is simple, don't buy, don't try, don't reply. But if you really can't resist, then be sure to read the small print.”

“The devil really is in the details. Be skeptical of terms and conditions which sound very broad – because they probably are."