{"id":698,"date":"2020-05-21T16:09:59","date_gmt":"2020-05-21T16:09:59","guid":{"rendered":"https:\/\/blog.bham.ac.uk\/itsecurity\/?p=698"},"modified":"2020-05-21T16:09:59","modified_gmt":"2020-05-21T16:09:59","slug":"increase-in-phishing-attacks","status":"publish","type":"post","link":"https:\/\/blog.bham.ac.uk\/itsecurity\/2020\/05\/21\/increase-in-phishing-attacks\/","title":{"rendered":"Increase in Phishing Attacks"},"content":{"rendered":"<p>We have had a lot of phishing attacks recently, many coming from University staff and student accounts that have given their username and password in response to an earlier attack.<\/p>\n<p>A lot of people are responding to these.\u00a0 The wording varies, but all follow a very traditional pattern for phishing messages.\u00a0 They include emails telling you that your account will expire, you have messages waiting, and your account needs to be validated.\u00a0 \u00a0The formatting and wording varies.\u00a0 Some have images in and some are just text.<\/p>\n<p>If you receive one, delete it.\u00a0 If you are aware that you have responded to a message, change your password immediately.<\/p>\n<p>All include a link to a website which asks for your login details and many look like an Outlook Web Access login page.<\/p>\n<p>The following is an example (names and email addresses have been changed)<\/p>\n<p style=\"padding-left: 80px\"><strong>From:<\/strong> Campus__Helpdesk &lt;i.b.phished@bham.ac.uk&gt;<br \/>\n<strong>Sent:<\/strong> 20 May 2020 14:56<br \/>\n<strong>To:<\/strong> Richard Trevithick (Engineering) &lt;r.trevithick@bham.ac.uk&gt;<br \/>\n<strong>Subject:<\/strong> Action Required For: r.trevithick@bham.ac.uk<\/p>\n<p style=\"padding-left: 80px\">You have (21) new Campus Schedule message<br \/>\nFollow link below to access this updates<\/p>\n<p style=\"padding-left: 80px\"><a href=\"http:\/\/updatevoiceexchange.com\/inculdes\/uvic\/uvic.html\">Review Scheduled Message Here<\/a><\/p>\n<p style=\"padding-left: 80px\">HelpDesk-Services 2020<br \/>\nSecurity Message<\/p>\n<p>There are plenty of indications that this should make you suspicious<\/p>\n<ul>\n<li style=\"list-style-type: none\">\n<ul>\n<li>The From: field an unusual name that might look a bit like the IT Service desk, but with a personal address.<\/li>\n<li>The message in this case makes no sense.\u00a0 What is a &#8220;Campus Schedule Message&#8221;?\u00a0 Why would you need to follow a link to &#8220;access this updates&#8221;?<\/li>\n<li>The link is to a site that has nothing to do with the\u00a0 University (http:\/\/updatevoiceexchange.com\/inculdes\/uvic\/uvic.html<\/li>\n<li>The message is signed HelpDesk-Services 2020, which is odd<\/li>\n<li>The University email system does not store batches of email which you need to retrieve in this way<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>More information on how to spot malicious emails is <a href=\"https:\/\/blog.bham.ac.uk\/itsecurity\/2016\/12\/22\/malicious-emails-and-how-to-spot-them\/\">available here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>We have had a lot of phishing attacks recently, many coming from University staff and student accounts that have given their username and password in response to an earlier attack. A lot of people are responding to these.\u00a0 The wording varies, but all follow a very traditional pattern for phishing messages.\u00a0 They include emails telling &hellip; <a href=\"https:\/\/blog.bham.ac.uk\/itsecurity\/2020\/05\/21\/increase-in-phishing-attacks\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Increase in Phishing Attacks&#8221;<\/span><\/a><\/p>\n","protected":false},"author":84,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,3,13],"tags":[],"class_list":["post-698","post","type-post","status-publish","format-standard","hentry","category-malicious-email","category-examples-of-malicious-email","category-phishing"],"_links":{"self":[{"href":"https:\/\/blog.bham.ac.uk\/itsecurity\/wp-json\/wp\/v2\/posts\/698","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.bham.ac.uk\/itsecurity\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.bham.ac.uk\/itsecurity\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.bham.ac.uk\/itsecurity\/wp-json\/wp\/v2\/users\/84"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.bham.ac.uk\/itsecurity\/wp-json\/wp\/v2\/comments?post=698"}],"version-history":[{"count":2,"href":"https:\/\/blog.bham.ac.uk\/itsecurity\/wp-json\/wp\/v2\/posts\/698\/revisions"}],"predecessor-version":[{"id":700,"href":"https:\/\/blog.bham.ac.uk\/itsecurity\/wp-json\/wp\/v2\/posts\/698\/revisions\/700"}],"wp:attachment":[{"href":"https:\/\/blog.bham.ac.uk\/itsecurity\/wp-json\/wp\/v2\/media?parent=698"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.bham.ac.uk\/itsecurity\/wp-json\/wp\/v2\/categories?post=698"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.bham.ac.uk\/itsecurity\/wp-json\/wp\/v2\/tags?post=698"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}