It seems that phishing scammers are again using some student accounts, either by direct access or address “spoofing” (a technique commonly used by spammers to hide the origin of their e-mails by using a forged return address ) to send phishing mail such as the one below to many university accounts.
The phishers attempt to trick the recipients of their mail into thinking that because the mail is from a “sun.ac.za” account, it is genuine.
The mail below is an obvious phishing scam and should not be responded to. Also, don’t click on the enclosed links or provide any usernames, passwords or personal details to the senders.
Looking at the mail below, note the following 5 “warning signs”.
- No personal salutation – Just “Valued Customer”.
- Intimidating threats should you not comply – “Failure to Update”.
- Request to click a link to verify your details or to provide usernames and passwords
- The link takes you to a webpage that might look legitimate but is not based in the university network. (this phishing scam originated in Sri Lanka)
- Poor grammar and spelling.
Never be fooled if a mail seems as if it was sent from a university address.
In this case, the e-mail address of an Agricultural Sciences student was used.
Information Technology does have a good automated mechanism for submitting spam. It is quite simple to use, but being automated there will be no indication or acknowledgement that the mail has been received by Information Technology:
- Start a new mail addressed to sysadm@sun.ac.za
- Use the Title “SPAM” (without quotes) in the Subject field.
- With this New Mail window open, drag the suspicious spam/phishing mail from your Inbox into the New Mail Window. It will attach the mail as an attachment and a small icon with a light yellow envelope will appear in the attachments section of the New Mail.
- Send the e-mail.
Do not “Forward” the Spam mail to this address. When you forward the original sender and all the information that the spam filters use to filter out the mail is lost and the Forwarded mail will be rendered useless for the filters.
Here is the mail that is circulating at the moment (malicious links have been removed):
From: Compromised, Student Account <12345678@sun.ac.za>
Sent: 23 February 2017 16:00
Subject: Mandatory Update
Dear Valued Customer,
STANDARD BANK MONETARY SERVICES
We wish to inform you that your Credit Card has been listed for suspension due to recent Error/Traffic on your previous transaction.
You are MANDATED to re-update your details here: https://dont.click.on.this.link.com
Failure to Update within 24Hours will Lead to your Banking Services Suspension/Interruption.
We are sorry for any inconveniences this might have caused you.
[ARTICLE BY DAVID WILES]
