Text of Phishing Message

From: Pugetsound/ADMIN <mailmag[@]pmaj[.]or[.]jp>
Subject: Error/in/Pugetsound/Outlook

I​n​c​o​m​i​n​g​ ​m​e​s​s​a​g​e​s​ ​f​o​r​ [username]@pugetsound.edu c​o​u​l​d​n​’​t​ ​b​e​ ​d​e​l​i​v​e​r​e​d​.

A​c​t​i​o​n​ ​R​e​q​u​i​r​e​d​ C​o​n​f​i​r​m​a​t​i​o​n​

F​i​x ​e​m​a​i​l​ i​s​s​u​e​s​ ​b​e​l​o​w​

https:\supports[.]azurefd[.]net#[username]@pugetsound[.]edu

Tips for Detection

• When a maroon caution banner is prepended to a message, please take extra time to examine the email address sender and any attachments/links before taking action.
• Notice the email address sending the message is from mailmag[@]pmaj[.]or[.]jp which should be suspicious.
• Notice the link to “fix email issues” does not go to a pugetsound.edu site. Remember, Puget Sound email can be accessed via webmail.pugetsound.edu.

Where Did the Link Lead?

The link led to a fake Microsoft Office login page. Do not enter your credentials on sites you do not recognize.