YouTube used to send spam

In August we reported that the spammers had created a Trojan designed to generate large numbers of Hotmail and Gmail accounts. This was coupled with an increase in spam originating from Hotmail and Gmail servers.

Now we are seeing a similar problem with YouTube. In the last few days we've had a surge in spam being sent from genuine YouTube servers. YouTube users have the facility to “Invite Your Friends”, which in effect allows them to send email to any address from their YouTube accounts. This functionality is what the spammers are exploiting. The spam message is just like any “Invite Your Friends” message, except that it includes the typical spam content and links to spam Web sites. The messages all come from service@youtube.com.

The key purpose of attacking YouTube (and HotMail and Gmail in other instances) is to defeat spam filters and to lower the recipient’s guard. The spam comes from a big-name company, from an email address which may already be excluded from spam filtering. In fact the YouTube Help Center suggests that you exclude the service@youtube.com address from spam filtering, something of which the spammers are probably keenly aware.