Message: UR Information Security has received a report of a new spear-phishing attempt against UR email users. Spear-Phishing is a phishing campaign tailored to a specific target group, using language or information to pacify suspicions of the target group.
This phishing attempt requests the user to send their password in a reply email. Please alert your communities to this threat and remind them that University IT will never ask for a password to be sent by email.
The Phishing message looks like this (Note that the return address is a Yahoo account):
From: "EMAIL.UR.EDU SUPPORT" <[log in to unmask]>
Date: January 24, 2008 9:36:14 AM EST
Subject: Confirm Your E-mail Address
Reply-To: [log in to unmask]
Dear Email.ur.edu Subscriber,
To complete your email.ur.edu account, you must reply to this email immediately and enter your password here (*********)
Failure to do this will immediately render your email address deactivated from our database. You can also confirm your email address by logging into your email.ur.edu account at https://email.ur.edu
Thank you for using EMAIL.UR.EDU!