Original Phishing Message

Note: If you received this email, please simply delete the message. Do not click on any links or reply. There is no need to contact the Technology Service Desk as we are aware and taking steps to mitigate the incident. Thank you!

Tips for Detection

• Notice the “Caution” banner appended to the message. Technology Services adds this banner on emails that match patterns of previous phishing attempts.
• The “To” field is completely empty which should be suspicious. This usually indicates an email is being sent to a large number of undisclosed recipients.
• Legitimate emails from our Service Desk ticketing system will come from an @pugetsound.edu address.

Where Did the Link Lead?

The link led to https://suvynhelpforallstffonline[.]weebly[.]com which would have displayed a fake Outlook login page. Notice the umlauts above some of the text which is suspicious. Weebly is a legitimate web hosting service, but attackers can sometimes host malicious content undetected.

Note: If you entered your credentials on this page, please immediately change your password and contact the Service Desk at x8585. Your credentials are likely compromised.

Tip: remember that the legitimate site to log in to your Puget Sound email is webmail.pugetsound.edu.

Text of Phishing Message

From: manuel.silva[@]georgfischer[.]com
Subject: RE: ITHelp Survey invitation.

You have been invited to take a Satisfaction survey for a recent IT-Help ticket.
Click here to take your survey
To view your survey queue at any time, sign in and navigate to Self-Service > My Assessments & Surveys.

Additional details about this Survey are:
Number #: INC1798292
Short Description: HELP-DESK ALERT.
Description:
Resolved Date: Today
Ref:MSG5211182