Phishing, viruses and advertising: a detailed analysis of types of email spam

Email remains the primary channel for business communication, but at the same time, it serves as the main «entry point» for various cyber threats. Every day, companies receive hundreds of messages, including promotional emails, fraudulent schemes, and malicious files.

In this article, we’ll explore the different types of email spam, how regular advertising differs from phishing, how to spot a dangerous email in a matter of seconds, and what steps can help protect corporate infrastructure.

Types of email spam

To build an effective defense system, you first need to understand what spam means in the modern sense. It’s not just mass mailings about discounts, but any unsolicited email that the user did not consciously consent to receive. However, based on the level of risk and the sender’s intent, all email noise can be clearly divided into three main categories.

1. Advertising spam.

These are mass mailings offering products or services, promotions, or webinars from companies to which you have not provided your contact information. The sender’s main goal is to attract attention and make a sale. Such emails create information overload and force you to spend work time cleaning out your inbox, but on their own, they rarely pose a direct threat to your device or data.

2. Phishing emails.

These are fraudulent messages designed to steal confidential information: passwords, usernames, credit card details, or access keys to corporate systems. Attackers disguise their emails as notifications from banks, email services, social media platforms, or even coworkers. Email phishing relies on social engineering manipulating a person into taking a reckless action through emotional influence.

3. Emails containing malicious software (malware).

These are the most dangerous emails, designed to secretly infect the user’s device. They contain dangerous attachments or links; clicking on them triggers the download of spyware, Trojans, or ransomware. In this way, viruses can infiltrate an entire corporate network via email, lock files, and demand a ransom to restore access.

What is email phishing and how do scammers make you believe their emails?

While promotional spam is designed to appeal to casual interest, phishing emails are crafted as precise psychological traps. Scammers rarely use complex technical exploits in the initial stage it’s easier for them to get users to voluntarily hand over their data.

Email attacks almost always rely on a person’s emotional reactions. Attackers simulate situations in which rational thinking gives way to impulsive actions:

• a false sense of urgency: demands to verify an account within 24 hours, or it will be blocked;
• appeal to fear: notifications about a «suspicious login attempt», a «penalty for non-payment», or a «lawsuit»;
• benefit and curiosity: notifications about an unexpected money transfer, a lottery win, or a «confidential document»;
• Authority: emails that mimic management directives, requests from the tax authority, or the company’s IT support team.

To build trust, scammers use spoofing falsifying visual elements and email addresses. They completely copy the corporate style of well-known companies, using their logos, fonts, and official wording. In the business environment, targeted phishing is often used, where attackers research a company’s structure in advance and send an email on behalf of the CEO requesting an urgent financial payment or the submission of a confidential report.

How to spot a suspicious or dangerous email

Most fraudulent and dangerous emails leave clues. By knowing how to spot phishing attempts and disguised viruses, you can neutralize the threat before it causes any harm.

To thoroughly check an incoming message, use this checklist of key indicators:

1. Suspicious sender address. Check not only the name displayed in the inbox but also the actual email address after the @ symbol. If the sender claims to be «Google Support» but the address ends with @account-update-sec.net, it’s a phishing attempt.
2. Mismatched hyperlinks. If you hover your mouse over a link in the text (without clicking on it), the actual URL will appear in the bottom corner of the screen. If the link text says mybank.ua but the actual address leads to a third-party website, the email is dangerous.
3. Unusual or suspicious attachments. Files with extensions such as .exe, .bat, or .vbs, as well as password-protected .zip or .rar archives, require extreme caution. Word or Excel documents that ask you to enable macros also pose a risk.
4. Requests for confidential information. No bank, government agency, or email service will ever ask for passwords, PIN, or full card numbers in an email.
5. Language errors and machine translation. Many mass attacks are coordinated from abroad, so emails often contain grammatical errors, unnatural phrasing, or a strange mix of languages.
6. Unexpected context. An email from a courier service about the delivery of a package you didn’t order, or an invoice from a supplier you don’t do business with, is a clear reason to verify the message.

Why email spam is dangerous for businesses

For individual users, email spam is primarily a minor inconvenience. For businesses, it is a direct source of financial, operational, and reputational threats. The scale of the consequences of a single employee error can extend far beyond a single computer.

Let’s examine the main business risks associated with unwanted and dangerous correspondence.

1. Financial losses due to Business Email Compromise (BEC). Attackers gain access to an email account or create a clone of it, then send the accounting department altered payment details for legitimate invoices.
2. Leakage of trade secrets and personal data. Through phishing forms, fraudsters gain access to corporate CRM systems, cloud storage, and customer databases.
3. Disruption of business processes. Ransomware, delivered via malicious attachments, encrypts critical files on servers, bringing the company’s operations to a halt for days or weeks.
4. Reputational risks and domain blocking. If a corporate email account is compromised, it can be used to send spam to other organizations. As a result, the company’s domain will be blacklisted, and your official emails will no longer reach partners and customers.

In addition, it’s important to consider the cumulative effect: employees spend an average of 15 to 30 minutes each day sorting, reading, and deleting unwanted emails. On a company-wide scale, this translates to dozens of hours of lost productivity every month.

What to do with a suspicious email and how to respond if you accidentally click a link

Every employee must clearly understand the procedure for handling email. This allows you to effectively combat spam and minimize the impact of human error.

If you have even the slightest doubt about the safety of an email or if a mistake has already occurred the most important thing is to act quickly and without panicking. Follow these steps:

1. Do not interact with the content. Do not click on any links, do not open any attached files, and do not reply to the sender.
2. Verify the sender through an alternative channel. If the email appears to be from a colleague, supervisor, or bank, call them or message them via a work messenger to confirm.
3. Use your email service’s features. Mark the email as «Spam» or «Phishing». This will help the email system’s algorithms better filter out similar messages in the future.
4. Change your passwords. From another (secure) device, immediately change the password for your email account and all other accounts whose credentials may have been compromised.
5. Run an antivirus scan. Perform a full system scan using licensed antivirus software.
6. Notify the appropriate personnel immediately if you accidentally clicked on a link. Inform the company’s IT specialists or security team about what happened. The faster the team responds, the less damage to the business.

How to protect yourself from email spam

Email security is not a one-time action but an ongoing process that combines technical settings and good user habits. To significantly reduce the amount of unwanted email and improve security, it’s worth implementing a few fundamental rules.

Reliable protection against spam is based on the following practical guidelines:

1. Enable two-factor authentication (2FA). This is the most effective barrier against account hacking, even if scammers manage to obtain your password through phishing.
2. Separate your email addresses. Use a separate work email exclusively for business correspondence. Set up a separate, additional email account for website registrations, newsletter subscriptions, and discount programs.
3. Do not publish your work email addresses publicly. Spammers use automated bots (parsers) to collect addresses from websites and forums. If you must provide an address on a website, use the format name [at] domain.com or secure web forms.
4. Unsubscribe from newsletters correctly. Only unsubscribe using the official «Unsubscribe» button in emails from trusted brands. If an email is clearly spam, do not click the «Unsubscribe» button this will only confirm to scammers that your email account is active.
5. Use complex and unique passwords. Do not use the same password for your email, CRM system, and personal accounts.

Basic digital literacy, regular employee training, and attention to detail transform email from a potential vulnerability into a secure and effective tool for growing your business.

Iryna Voitovych

Copywriter

Author's page