Original Simulated Phishing Message

Note: This email was sent by Technology Services to simulate a real phishing email as part of National Cyber Security Awareness Month. Visit pugetsound.edu/NCSAM2020 for more information. The goal of simulated phishing is to provide an interactive way for campus members to learn how to quickly recognize and handle phishing emails.

Tips for Detection

Caution Banner

Technology Services adds a “Caution” banner at the top of email messages containing specific keywords that have appeared on multiple occassions in previous phishing attacks. If you see this banner, proceed with caution. Please know that the absence of the banner does NOT necessarily mean an email is safe.

Invoking Fear and Urgency

Ransomware is definitely a real threat and this message is meant to incite a panicked response. Nobody wants to lose their important files or be threatened to pay bitcoin to recover documents. The sense of urgency can prompt anybody to desire quick action to resolve the situation.

Don’t fall for it! Stop and think.

Impersonating Microsoft Support

Many phishing emails and browser pop-ups impersonate Microsoft. Though it would be benevolent of Microsoft to be on the lookout for everyone, their support team does NOT in fact email people if a computer running Windows becomes infected with malware.

As always, check the sending email address and hover over hyperlinked text to see where it leads. You will notice that this email does not originate from the microsoft.com domain.

Text of Simulated Phishing Message

From: Microsoft Support <ransomwarenotice[@]gmail[.]conn>
Subject: ALERT – Microsoft Detected Ransomware

Hello,

Microsoft Security Essentials has detected ransomware on your computer. The ransomware will encrypt all your files and you will lose all access to your documents and pictures.

To prevent the ransomware from spreading, click this link immediately to start a remote session with a Microsoft Customer Support representative who will walk you through removing the threat. Microsoft is committed to your security and has agents ready to help you.

Thank you,
Microsoft Corporation
1 Microsoft Way, Redmond, WA, 98052