UVic End User

This phish tries to trick the user into thinking they broke the law or violated policy:

It redirects to a phish page complete with UVic Edge branding, logos, and terminology.  While it looks pretty and official, it’s certainly phishing.

Once you enter your NetLink ID and password, it presents you with a nice Thank You page:

An example of email spoofing in a COVID-19 phish

Sometimes an email will look like it came from a legitimate sender, but in reality the sender email was faked. This is called email spoofing, and the phish below gives a good example of that. Here, the phisher spoofed distributions@grants.gov, but a close look at the mail headers revealed that it did not come from grants.gov and replies to the message would actually be sent to a different, very suspicious-looking address.

Covid 19 Message From President Cassels

This carefully-crafted spear phish for the most part looks like it could have been written by Jamie Cassels–but of course it wasn’t. One of my colleagues found that the phisher actually copied much of the wording from an April 22 open letter from the president of McMaster University.

If you recall opening the attached PDF, please contact your departmental support staff or the Computer Help Desk as soon as possible.

Outlook Security Update

This phish mentions phishing to trick you into thinking it’s a legitimate email.

However, it goes to a URL that is clearly not a Microsoft site.  Notice how the word “Password” has been changed to use special characters to avoid detection by automatic scanners.