Several of our observant personnel have picked up that a very suspicious e-mail is making the rounds at the moment.

The subject is “NOTIFICATION: Your 13.69% Salary Increase”. 

This is a very dangerous e-mail. Clicking on the link will take you to a forged version of the SUN e-HR site. If you enter your username and password (because the site looks like the SUN e-HR site), the criminals will have been given access to your personal details on SUN e-HR. The ramifications of this will mean that the scammers will potentially be able to get details such as your banking details, ID number, place of residence, that are all stored on the SUN e-HR system. They will potentially then be able to steal your salary.

The e-mail contains the following message:

Hello,

Attached herewith are two (2) documents summarizing your April salary as reviewed for a 13.69% merit increase in Financial Year 2017.

This review is with immediate effect starting Friday April 28th Paycheque.

Deductions and bonuses are advised therein

The documents are attached below:

…

Below is what the forged site looks like. The address is not a university server BUT very few people notice such details and tend to skim over them.

[ARTICLE BY David Wiles]

It seems that phishing scammers are again using some student accounts, either by direct access or address “spoofing” (a technique commonly used by spammers to hide the origin of their e-mails by using a forged return address ) to send phishing mail such as the one below to many university accounts.

The phishers attempt to trick the recipients of their mail into thinking that because the mail is from a “sun.ac.za” account, it is genuine.

The mail below is an obvious phishing scam and should not be responded to. Also, don’t click on the enclosed links or provide any usernames, passwords or personal details to the senders.

Looking at the mail below, note the following 5 “warning signs”.

1. No personal salutation – Just “Valued Customer”.
2. Intimidating threats should you not comply – “Failure to Update”.
3. Request to click a link to verify your details or to provide usernames and passwords
4. The link takes you to a webpage that might look legitimate but is not based in the university network. (this phishing scam originated in Sri Lanka)
5. Poor grammar and spelling.

Never be fooled if a mail seems as if it was sent from a university address.

In this case, the e-mail address of an Agricultural Sciences student was used.

Information Technology does have a good automated mechanism for submitting spam. It is quite simple to use, but being automated there will be no indication or acknowledgement that the mail has been received by Information Technology:

1. Start a new mail addressed to sysadm@sun.ac.za
2. Use the Title “SPAM” (without quotes) in the Subject field.
3. With this New Mail window open, drag the suspicious spam/phishing mail from your Inbox into the New Mail Window. It will attach the mail as an attachment and a small icon with a light yellow envelope will appear in the attachments section of the New Mail.
4. Send the e-mail.

Do not “Forward” the Spam mail to this address. When you forward the original sender and all the information that the spam filters use to filter out the mail is lost and the Forwarded mail will be rendered useless for the filters.

Here is the mail that is circulating at the moment (malicious links have been removed):

From: Compromised, Student Account <12345678@sun.ac.za>

Sent: 23 February 2017 16:00

Subject: Mandatory Update 

Dear Valued Customer, 

STANDARD BANK MONETARY SERVICES 

We wish to inform you that your Credit Card has been listed for suspension due to recent Error/Traffic on your previous transaction. 

You are MANDATED to re-update your details here: https://dont.click.on.this.link.com 

Failure to Update within 24Hours will Lead to your Banking Services Suspension/Interruption.

We are sorry for any inconveniences this might have caused you.

[ARTICLE BY DAVID WILES]