Is this account change PDF email (supposedly from Paypal) an exploit?

This is just regular malware spam.

The evil part of this message is likely the attached PDF it mentions. It likely contains an exploit which targets a vulnerability in one or more PDF readers and does something bad if opened with a vulnerable program. So do not open the attachment.

The reason for the gibberish text in the email's sourcecode is likely to confuse spam filters so they don't filter it.


This is some sort of over-engineer malware spam, that escape typical email-client (e.g. outlook client) simple spam filter due to the gibberish text. However, it is useless against well maintained spam mail scanning engine that capable to handle HTML spam email that look for suspicious/obfuscated javascript code.

(update) As some mentioned that email client will not execute javascript to do the de-obfuscation. A simple google of "Obfuscated spam email" you will get some similar example. Since OP didn't show us the actual email header, I can only assume that the content is deobfuscate and rewrite using javascript.

I just discover it is possible to use CSS stylesheet to fool around, but you still need javascript . All these obfuscated-deobfuscated mechanisms will expose the spam to help build some sort of spam detection.


The gibberish is intended to confuse the virus- and/or spam filters. If the filter reads the actual (gibberish) text, it will not recognize the trigger words or patterns, as I would assume the gibberish letters are generated randomly and are different for every message. Some spam filters such as the one from gmail rely on identifying spam messages because they are identical to messages sent to other users as well.

Depending on the quality of the filters, this kind of obfuscation may or may not work. But the principle of spam is that it doesn't have to work on everyone, only on enough targets. So as long as it bypasses some filters, it is worth using it.

Tags:

Phishing