{ "id": "7bc41eaa-e966-41aa-9867-a96654e0303d", "created_at": "2026-04-06T00:07:29.462601Z", "updated_at": "2026-04-10T13:12:10.763665Z", "deleted_at": null, "sha1_hash": "13d11aec3ae68a3cce644c2587469f6a6142c6c0", "title": "World's Largest Spam Botnet Is Pumping and Dumping an Obscure Cryptocurrency", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 817621, "plain_text": "World's Largest Spam Botnet Is Pumping and Dumping an Obscure\r\nCryptocurrency\r\nBy Catalin Cimpanu\r\nPublished: 2018-01-17 · Archived: 2026-04-05 16:43:55 UTC\r\nNecurs, the world's largest spam botnet, is currently sending millions of spam emails that push an obscure cryptocurrency\r\nnamed Swisscoin.\r\nSuch spam emails are known as pump-and-dump, and the technique relies on sending large quantities of spam to drive\r\ninterest up towards a particular penny stock.\r\nSpammers usually buy stock in advance at a low price and sell it at a higher value when the spam campaign drives up the\r\nprice —hence the name of pump \u0026 dump.\r\nhttps://www.bleepingcomputer.com/news/cryptocurrency/worlds-largest-spam-botnet-is-pumping-and-dumping-an-obscure-cryptocurrency/\r\nPage 1 of 4\n\nhttps://www.bleepingcomputer.com/news/cryptocurrency/worlds-largest-spam-botnet-is-pumping-and-dumping-an-obscure-cryptocurrency/\r\nPage 2 of 4\n\nVisit Advertiser websiteGO TO PAGE\r\nNecurs pushes cryptocurrencies for the first time\r\nNecurs, a spam botnet believed to have millions of bots, has been known to engage in pump-and-dump spam campaigns for\r\nyears, being one of its primary activities, besides spreading the Dridex banking trojan, and several ransomware families.\r\nWhat caught our eye and the attention of several security researchers was the fact that Necurs started promoting a\r\ncryptocurrency this week, instead of the usual low-end penny stocks that it got us accustomed to.\r\nIn a private conversation with Bleeping Computer, Derek, the security researcher behind the MyOnlineSecurity blog,\r\nconfirmed to us that this was, indeed, the first time Necurs has promoted a cryptocurrency via one of its infamously large\r\nspam campaigns.\r\nNecurs pushing Swisscoin\r\nThe cryptocurrency in question is Swisscoin, an altcoin that's been described as a Multi-Level-Marketing (MLM) ponzi\r\nscheme in a report last year, and for which trading was recently suspended.\r\nTrading resumed on January 15, the same day the Necurs spam started spreading. Since the Necurs spam, the cryptocurrency\r\nlost 40% of its initial trading price.\r\nIt's unclear what is Necurs' impact on the Swisscoin trading price, mainly because there was no previous trading to compare\r\nthe impact against.\r\nFurther, the price dip could be very well the result of people dumping Swisscoin when trading finally resumed after more\r\nthan 50 days, and not necessarily the result of the \"dump\" phase following a Necurs pump-and-dump. In addition, Bitcoin's\r\ndeclining price could have also affected Swisscoin's own price.\r\nAccording to reports from Conrad Longmore, VirusBulletin, and MyOnlineSecurity, the Necurs botnet has sent three\r\ndifferent spam runs with the following subject lines:\r\nThis crypto coin could go up fifty thousand percent this year\r\nLet me tell you about one crypto currency that could turn 1000 bucks into 1 million\r\nForget about bitcoin, there's a way better coin you can buy.\r\nIt was also seen sending dating spam and emails carrying files that spread the GlobeImposter ransomware.\r\nThe messages pushing the Swisscoin pump-and-dump were part of a huge spike in activity from the Necurs botnet, which\r\ncame back to life this week after its annual holiday vacation. Each year, the Necurs botnet takes a break between early\r\nDecember and mid-January, as Necurs operators celebrate the end-of-year holidays.\r\nNecurs operators taking a page out of John McAfee's book\r\nWe can only speculate on what drove Necurs operators to pump-and-dump cryptocurrencies, but we believe that John\r\nMcAfee might have something to do with their decision.\r\nFor the past few weeks, the founder of the McAfee cyber-security firm has been promoting various cryptocurrencies in what\r\nhe calls \"Coin of the Day\" tweets.\r\nThe cryptocurrencies McAfee promotes on his Twitter account almost always see a huge price spike that many users have\r\nexploited to dump coins at higher prices.\r\nhttps://www.bleepingcomputer.com/news/cryptocurrency/worlds-largest-spam-botnet-is-pumping-and-dumping-an-obscure-cryptocurrency/\r\nPage 3 of 4\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/cryptocurrency/worlds-largest-spam-botnet-is-pumping-and-dumping-an-obscure-cryptocurrency/\r\nhttps://www.bleepingcomputer.com/news/cryptocurrency/worlds-largest-spam-botnet-is-pumping-and-dumping-an-obscure-cryptocurrency/\r\nPage 4 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "origins": [ "web" ], "references": [ "https://www.bleepingcomputer.com/news/cryptocurrency/worlds-largest-spam-botnet-is-pumping-and-dumping-an-obscure-cryptocurrency/" ], "report_names": [ "worlds-largest-spam-botnet-is-pumping-and-dumping-an-obscure-cryptocurrency" ], "threat_actors": [], "ts_created_at": 1775434049, "ts_updated_at": 1775826730, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/13d11aec3ae68a3cce644c2587469f6a6142c6c0.pdf", "text": "https://archive.orkl.eu/13d11aec3ae68a3cce644c2587469f6a6142c6c0.txt", "img": "https://archive.orkl.eu/13d11aec3ae68a3cce644c2587469f6a6142c6c0.jpg" } }