This week’s Monday morning phishing scam is in the form of a rather poorly worded “WARNING” about exceeding the limit of your email.

The three exclamation marks (!!!) in the Subject line should immediately be a warning. Just because it comes from “Stellenbosch University Upgrade Team 2017” doesn’t guarantee that it is genuine!

Here is what the phishing email looks like (With the dangerous parts removed):

From: Stellenbosch University Upgrade Team 2017 [mailto:forged_address@webmail.co.za]

Sent: Monday, 24 July 2017 10:49 AM

Subject: Urgent Notification !!!

Urgent notification ,

You have exceeded your mail limit , Your account will be blocked from sending and receiving messages if your account is not been upgraded, upgrade your account free now Via the weblink Below :

http://dont_click.on.this.link

If your account have been upgraded please ignore this, this is for all student and stafs please Thank you.

Webmail © 2017

Email: forged_address@webmail.co.za

Here are # tips below can help you spot a  phishing scam:

1. Unofficial “From” address. Look out for a sender’s email address that is similar to, but not the same as, a company’s official email address. These email addresses are meant to fool you.
2. Urgent action required. Fraudsters often include urgent “calls to action” to try to get you to react immediately. Be wary of emails containing phrases like “your account will be closed,” “your account has been compromised,” or “urgent action required.” The fraudster is taking advantage of your concern to trick you into providing confidential information.
3. Generic salutation. Fraudsters often send thousands of phishing emails at one time. They may have your email address, but they seldom have your name. Be sceptical of an email sent with a generic greeting such as “Dear Customer” or “Dear Member”.
4. Link to a fake web site. To trick you into disclosing your user name and password, fraudsters often include a link to a fake web site that looks like (sometimes exactly like) the sign-in page of a legitimate web site. Just because a site includes a company’s logo or looks like the real page doesn’t mean it is!
5. Spelling errors, poor grammar, or inferior graphics.
6. Requests for personal information such as your password, user name, or bank account or credit card number. Legitimate companies will never ask you to verify or provide confidential information in an unsolicited email.
7. Attachments (which usually contain viruses, malware or ransomware).

If you have received mail that looks like this please immediately report it to the Information Technology Security Team using the following method:

Send the spam/phishing mail to the following addresses

help@sun.ac.za and sysadm@sun.ac.za as well.

Attach the phishing or suspicious mail on to the message if possible. There is a good tutorial on how to do this at the following link (Which is safe): http://stbsp01.stb.sun.ac.za/innov/it/it-help/Wiki%20Pages/Spam%20sysadmin%20Eng.aspx

1. Start up a new email addressed to sysadm@sun.ac.za (CC: csirt@sun.ac.za and help@sun.ac.za
2. Use the Title “SPAM” (without quotes) in the Subject.
3. With this New Mail window open, drag the suspicious spam/phishing mail from your Inbox into the New Mail Window. It will attach the email as an enclosure and a small icon with a light yellow envelope will appear in the attachments section of the New Mail.
4. Send the email.

If you did click on the link of this phishing spam and unwittingly give the scammers your username, e-mail address and password you should immediately go to http://www.sun.ac.za/useradm and change the passwords on ALL your university accounts (making sure the new password is completely different, and is a strong password that will not be easily guessed.) as well as changing the passwords on your social media and private email accounts (especially if you use the same passwords on these accounts.)

[Article by David Wiles]

About a year ago a new version of the ABSA Bank phishing email hit the university email server. What was new about this version was that the email was in Afrikaans. Although the Afrikaans was not perfect with some spelling and grammar mistakes, it still could have fooled many people, because of the “familiarity” component.

Stellenbosch University still uses a lot of Afrikaans as its primary official communications medium, and many automated systems like the Financial system use Afrikaans to inform users of payments etc. While there is nothing wrong with this, phishing scammers have latched onto this and are now attempting to fool people into divulging their personal details using Afrikaans in their phishing e-mails.

We were warned early this morning about an email that was originating from UCT with dangerous content, and almost immediately the UCT phishing emails started arriving.

Here is what to look out for:

Mail will arrive from a forged or compromised “UCT address” that will look like this:

From: Anna Huang [mailto:forged_address@myuct.ac.za]
Sent: 19 July 2017 10:53 AM
To: Recipients <forged_address@myuct.ac.za>
Subject: Re: betaling aan jou rekening

Goeiemore,

Vind aangehegte betalingsbewys.

Dankie

Disclaimer – University of Cape Town This e-mail is subject to UCT policies and e-mail disclaimer published on our website at http://www.uct.ac.za/about/policies/emaildisclaimer/ or obtainable from +27 21 650 9111. If this e-mail is not related to the business of UCT, it is sent by the sender in an individual capacity. Please report security incidents or abuse via csirt@uct.ac.za

The disclaimer from the University and the Afrikaans could fool some people if they are not careful.

The dangerous part is actually an attached html files (sometimes it might look like a PDF) that will present you with a login page where you will be asked to give your e-mail address and your password to “view this payment”

The login page will look like this, in this version:

The actual server’s address is also hidden by encoding it, so to the untrained eye, nothing will look suspicious. This is a typical phishing scam, but with the “sender” coming from a neighbouring academic institution, and the language being Afrikaans, we need to be even more alert.

[Article by David Wiles]