Month: August 2026

This example is not another phishing email. Instead, it is a smishing attack, where criminals use SMS text messages to deliver their lure.

The message claims to come from “UVic HR” and states that a performance review is ready for viewing. The sender attempts to add legitimacy by using the university’s name and a routine HR topic that may be relevant to many employees. Recipients are then directed to click a shortened URL to access the alleged review.

There are several signs that this message is not legitimate:

• The text originates from an unknown phone number, not an official UVic communication channel.
• The sender uses a shortened URL, making it impossible to determine the actual destination before clicking.
• The message includes the recipient’s name, but don’t let that fool you. Attackers frequently personalize their messages using information obtained from public sources or previous data breaches. A personal greeting is not proof that a message is legitimate.
• Performance reviews and other HR-related information would be accessed through established university systems, not through links delivered by unsolicited text messages.

One notable aspect of this attack is that it attempts to move the interaction outside of UVic’s email environment. Security controls, phish filtering, and reporting mechanisms are most effective when communications remain within university-managed systems. By contacting recipients directly through SMS, attackers hope to avoid those protections and create a greater sense of trust and urgency.

Like phishing emails, smishing messages often rely on curiosity, urgency, or fear to encourage quick action. Taking a moment to pause and think critically is often all it takes to avoid becoming a victim.

Do not click suspicious links, do not reply to unexpected text messages, and do not provide personal information or credentials. Stay vigilant and think before you click.


Here is the transcript of the message:
From: +1 (855) 699-<redacted>
Uvic HR: Dear <your name>!
Your performance review is ready for viewing:
https://kla4.io/<redacted>

This phish was received by many UVic recipients. It impersonates the University of Victoria Human Resources department.

The message attempts to create a sense of urgency by asking recipients to complete an “Annual Conflict of Interest Check-In” through a purported HR portal. Recipients are encouraged to click a button labeled “Go to HR portal”, which is designed to direct users to a fraudulent website with the goal of stealing your UVic credentials.

Several indicators reveal that this message is not a legitimate university communication:

• External Sender – The email claims to be from the University of Victoria (display name – “University of victoria”), but it comes from a non-UVic domain.
• No Subject Line
• Threat actors frequently use topics that appear routine and administrative because they are less likely to raise suspicion.
• Pressure to Act – encourages recipients to complete the task “this week” and notes that responses are needed from every team member. Creating urgency is a common phishing tactic designed to reduce careful scrutiny.
• Suspicious Link – The email contains a button labeled “Go to HR portal”. In fact it points to an external web site.

As always, please resist the temptation to click suspicious links. Malicious websites may contain payloads that can compromise your device. If you receive a suspicious email, report it instead. Our Information Security team investigates these sites safely in a secure lab environment.

The transcript of the body of the message follows for your information.

---

UNIVERSITY OF VICTORIA HR
Annual Conflict of Interest Check-In
Hi , <redacted>
It’s that time of year again for our quick Code of Conduct and Conflict of Interest check-in. I know these forms can feel like routine paperwork, but we ask everyone to complete one—even if you have nothing new to report! Here are the quick steps:

Hit submit—no attachments or signatures required.
Go to HR portal
Could you please take a quick moment to wrap this up sometime this week? It usually takes less than two minutes, and because we need a response from every team member, your submission really helps us stay on track.
If you have any questions at all, feel free to reply directly to this email—I’m happy to help.
Thanks so much for your time,
HR at University of victoria

Log into the HR portal and open the “Conflict of Interest” form.

Review the brief questions—if nothing applies to you, simply select “nothing to report.”