So then this guy sets up offshore accounts online (in Brazil, I think) to collect the investments. His guys all buy something like 10,000 shares at 30 cents per. Then the botnet goes to work. Starts mass mailing the ads for the stocks. And the beauty part is those little messages get by all the spam filters because the filters are looking for text, but with the image spam all the filters see is a million different images, each one unique, even though they all say the same thing: Buy this stock. (For more about this technique, read The Scourge of Image Spam.)

Genius. Finally, enough people invest to drive up the price. Eighty cents a share. A buck. Two. Eventually, our guys sell, make a nice chunk of change, the stock tanks and the suckers who got in on the e-mail tip lose their shirts. Like I said, a classic pump-and-dump, but back in the day it was a lot harder to do. It required a lot of legwork, relationships with reporters and brokers. Compared to that, this is, like, nothing.

I know what you’re thinking: Who believes an anonymous e-mail that says such-and-such company you’ve never heard of is at a quarter a share now but is heading to five bucks? Hey, I don’t know, but you send out 10 million messages, you get 1,000 to invest, that’s only, what? A hundredth of a percent? I’d say the sucker population is a lot bigger than that.

It was a great little business. One of those stocks hit six bucks! But then the feds sniffed it out and suspended trading on those penny stocks in March. Maybe when things cool off, it’ll pick up again. By that time, the spam filters will probably have adjusted and we’ll have to go back to the programmers for their latest bots.

Everyone Wants IDs, Just Not Their Own
The big money is in credentials.

Look, the world runs on credit, and what you need to get credit are personal credentials. That’s what everyone is after right now. And that’s where a lot of our investments are: credentials for lines of credit.

That TJX thing last January? No, not me. But let’s say I had beers with someone who might have worked on that job. It sounds like the heist of the century, right? What, 40 million personal records? But really it’s pretty basic stuff. If you want to get into the credentials market, you do three things: One, get inside access to someone who stores lots of personal data. Retail is great for that. Think about how many cards are swiped every second at those places. Two, invest in antiforensics, because once you’re in, you want to stay invisible until you’re done. (For more on antiforensics, see How Online Criminals Make Themselves Tough to Find, Near Impossible to Nab.) Three, after you got the credentials, behave. I’ll explain that one in a minute.