{"id":769,"date":"2021-10-22T17:08:41","date_gmt":"2021-10-23T00:08:41","guid":{"rendered":"https:\/\/onlineacademiccommunity.uvic.ca\/phishbowl\/?p=769"},"modified":"2021-10-25T10:53:44","modified_gmt":"2021-10-25T17:53:44","slug":"you-have-received-2-file-via-we-transfer","status":"publish","type":"post","link":"https:\/\/onlineacademiccommunity.uvic.ca\/phishbowl\/2021\/10\/22\/you-have-received-2-file-via-we-transfer\/","title":{"rendered":"You have received (2) file via We-Transfer"},"content":{"rendered":"

This phish comes with a relatively innocent subject suggesting you were sent files by “wetransfer” (a free file exchange platform). It contains a “Get your files” button and a separate “download link” which on screen seems to point to wetransfer.com.
\nWhat’s really dangerous about this phish is that both the button and the download link in fact point to a malicious site which has nothing to do neither with wetransfer, nor with UVic.\u00a0 The actual URL (pointed by the red arrow in the screenshot below) can be seen if you hover the mouse cursor over the link. \u00a0 That site contains a copy of the main UVic page and asks you to login with your UVic credentials.\u00a0 It looks so real that you may forgot what was the initial email about and you may forgot to check the address in the address bar.<\/p>\n

\"\"<\/p>\n

——————————————————————————————-<\/p>\n

And below is how the fake UVic page looks like. Note the malicious site address in the address bar.\u00a0 As always – we suggest not to be curious and not to click on such links even for a quick look. Some of them may contain malware and infect your machine almost instantly. Our experts open those in dedicated isolated environments.<\/p>\n

\"\"<\/p>\n","protected":false},"excerpt":{"rendered":"

This phish comes with a relatively innocent subject suggesting you were sent files by “wetransfer” (a free file exchange platform). It contains a “Get your files” button and a separate “download link” which on screen seems to point to wetransfer.com. What’s really dangerous about this phish is that both the button and the download link … Continue reading You have received (2) file via We-Transfer<\/span><\/a><\/p>\n","protected":false},"author":738,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"image","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-769","post","type-post","status-publish","format-image","hentry","category-uncategorized","post_format-post-format-image"],"_links":{"self":[{"href":"https:\/\/onlineacademiccommunity.uvic.ca\/phishbowl\/wp-json\/wp\/v2\/posts\/769","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/onlineacademiccommunity.uvic.ca\/phishbowl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/onlineacademiccommunity.uvic.ca\/phishbowl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/onlineacademiccommunity.uvic.ca\/phishbowl\/wp-json\/wp\/v2\/users\/738"}],"replies":[{"embeddable":true,"href":"https:\/\/onlineacademiccommunity.uvic.ca\/phishbowl\/wp-json\/wp\/v2\/comments?post=769"}],"version-history":[{"count":3,"href":"https:\/\/onlineacademiccommunity.uvic.ca\/phishbowl\/wp-json\/wp\/v2\/posts\/769\/revisions"}],"predecessor-version":[{"id":776,"href":"https:\/\/onlineacademiccommunity.uvic.ca\/phishbowl\/wp-json\/wp\/v2\/posts\/769\/revisions\/776"}],"wp:attachment":[{"href":"https:\/\/onlineacademiccommunity.uvic.ca\/phishbowl\/wp-json\/wp\/v2\/media?parent=769"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/onlineacademiccommunity.uvic.ca\/phishbowl\/wp-json\/wp\/v2\/categories?post=769"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/onlineacademiccommunity.uvic.ca\/phishbowl\/wp-json\/wp\/v2\/tags?post=769"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}