Spam filters work by evaluating (among other things) the reputation and the destination of links included in emails, so spammers are attempting to bypass the filters by making the first "jump" to a instinctively trustable Google domain, and then to a poorly maintained URL shortener.
"Clicking on the link sends us to Google translate. Google translate fetches the shortened URL and follows it to playandstudy.org, a hacked wordpress-based website in France. Playandstudy.org returns Russian text that translates to "Redirected to the requested page..." and Google translate displays that on its page in an iframe," the researchers explained.
The attack ends up with the user finally being redirected to a rogue pharmacy site.
The researchers point out that the trick does not work all the time, making them believe that Google may be implementing code that defeats "framebusting". In any case, users are advised not to inherently trust similar links, especially when they are delivered in unsolicited emails.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.