Email continues to be the main vector through which malware is delivered and through which people have their credentials stolen.This often happens in opportunistic (i.e. non targeted) campaigns, which distinguishes them from very targeted spear-phishing campaigns. Yet these 'malspam' campaigns also differ in a number of fundamental ways from ordinary spam, which positively affects their effectiveness and negatively affects our ability to analyse them.In this talk, I will explain how most malspam campaigns differ from ordinary spam, how this makes them a lot better at bypassing email filters and how this affects their visibility. I will also discuss more general trends when it comes to malspam.From this talk, the audience will hopefully get a better understanding of modern email-based threats and get some advice on how to analyse them and how to protect against them in a corporate environment.