MessageLabs reports that spammers have introduced MP3 music files into their expanding toolbox of stock spam techniques, with 15 million emails identified in October 2007.

We’ve been concerned for a couple years about the potential of audio spam. With the rise of speech-to-text based search in products like PodZinger, it’s only a matter of time before spammers start packing audio files with popular keywords in order to get noticed. This could cause major headaches for podcast and video search sites.

At this point, though, spammers are using audio files as a way of getting through email spam filters.

On October 17, MessageLabs intercepted the first copies of an estimated 15 million email spam run which lasted 36 hours and used StormWorm infected computers to disseminate the emails. Purporting to be a legitimate music file, the MP3 file names were all music-related such as beatles.mp3, Britney.mp3 and elvis.mp3, and contained a rusty-sounding, 25-second voice-over touting the latest stock offering from Exit Only Incorporated. The voice was synthesized using a very low compression rate of 16 kHz to keep the overall file size small, at around 50 KB, to avoid detection.

“The MP3 spam tactic is a natural progression for cyber criminals following runs of image, PDF and Excel junk mail earlier this year,” said Mark Sunner, chief security analyst for MessageLabs. “As users become wary of certain file attachments, scammers will move on to their next tactic, ever hopeful of finding the key which will easily open all inboxes rather than having the door slammed in their face by anti-spam filters. Video spam and PowerPoint are both well anticipated so watch this space for the next format du jour.”

MessageLabs experts believe that it is only a matter of time before the spammers apply the same approach to audio spam and upload the message to free multimedia hosting sites such as YouTube, Google Video, MySpace or any number of sites competing in this new media market.

via ZD