We have noticed numerous phishing scams targeted at SU mailboxes. Please note that these, like the example below, are NOT from the IT Helpdesk and are only an attempt to source your username and password. 

You will not be asked by IT to verify your account, we have automatic ways to do this. Secondly, our e-mails will be branded and both in Afrikaans and English. Hopefully they will also have less spelling mistakes than most of these phishing e-mails. 

We realise that it might be confusing, but if in any doubt, please e-mail us (help@sun.ac.za or 021 808 4367) to make sure whether these e-mails are legitimate.

From: SUN Support [mailto:phishing@dummyaddress.com]
Sent: 28 September 2016 09:40 AM
Subject: Notice

Dear User

To re-validate your mail account please click on the below link and enter your user id and password for the upgrade of your Account and Maintenance, Very Important. 

Click here

Your Mail account will be permanently terminated in a short time for failure to adhere to our urgent notice.

Thank you for your cooperation.

SUN Mail Support

© 2016 Stellenbosch University. All Right Reserved.

Please note that there is currently a new, and dangerous phishing scam making the rounds throughout the university.

Unfortunately, several *internal* e-mail addresses, including students and personnel that were earlier compromised, are being used to spread the phishing scam. With both students and personnel being distracted by the FeesMustFall protest actions both within the faculty and at the Main Campus, they are less alert to the ongoing threat from outside and this seems to have resulted in a number of personnel and student account details being “hijacked”and used.

The mail comes from a university address, so victims think that it has to be legitimate, which heightens the threat.

Below is the phishing scam. Please do not respond to it. The criminals are trying to trick you into providing them with your e-mail details and password. These are used to gain access to the account which is then used to propagate the scam further and gain access to more personal data within the university.

The dangerous part of the phishing scam has been deactivated by removing the link to the phishers server currently in Brazil and redirecting them to an internal page.

From: Compromised University Address <noreply@sun.ac.za>
Sent: Wednesday, 21 September 2016 05:59
Subject: ITS Service Desk

With the strengthening off our security system and improving your mailing experience, We have detected your mail settings are out of date. To enhance computer system security and comply with federal audit requirements, ITS requires all Sever Users to update their account , kindly click ITS to update your account to the latest OutlookWebApp . Sign in and automatically update your mailbox by filling out the requirements correctly.

___________________
Sincerely,
ITS Service Desk
Click Here

[ARTICLE BY DAVID WILES]

 Phishing scams disguised as an e-mail from The IT Admin Desk, asking you to upgrade your e-mail, are nothing new. This week two more of these e-mails, from the same source, have been sent to SU staff’s mailboxes. One is from the ADMIN TEAM and another from IT SERVICE DESK.

Both e-mails ask you to “log in” to update or verify your account, using the link included. Both are sent from compromised e-mail accounts from Minnesota and Iowa educational institutions. One diverts to a server controlled by scammers in Brazil and the other California. However, both use a forged “login page” and the same details.

Do not respond to these e-mails or go to the site given in the e-mail. Do not fill in your username, password or other details on any site. Stellenbosch University Information Technology has no need for users to provide user names and passwords on any site other than www.sun.ac.za/useradm, where you can manage your network account. We are also able to upgrade or migrate your e-mail account without asking you to assist.

Our e-mails will always be branded and in Afrikaans and English. If you are unsure about an e-mail you received, speak to your local computer expert or ask the IT Service Desk (021-8084367 or helpinfo@sun.ac.za).

Here is an example of the phishing mail: 

From: I, Amscammer

Sent: Thursday, July 14, 2016 5:56 AM

To: 1,Amscammer

Subject: ADMIN TEAM/IT SERVICE DESK/IT HELPDESK/IT SUPPORT/WEBMAIL ADMIN (and all variations you could think of) 

Dear E-mail User:- 

Take note of this important update that our new webmail has been improved with a new messaging system from Owa/outlook which also include faster usage on e-mail, shared calendar,web-documents and the New 2016 Anti-Spam Version. 

Please use the link below to complete your update for our new Owa/outlook improved webmail.

Log on to Outlook Web Access<http://iam.aspammer.com> to update your mailbox.

ITS Help Desk
ADMIN TEAM
©Copyright 2016 Microsoft Outlook
All Right Reserved.

[INFORMATION SUPPLIED BY DAVID WILES]