{"id":257,"date":"2021-01-28T12:48:05","date_gmt":"2021-01-28T20:48:05","guid":{"rendered":"http:\/\/blogs.pugetsound.edu\/infosec\/?p=257"},"modified":"2021-02-04T10:55:47","modified_gmt":"2021-02-04T18:55:47","slug":"phishing-from-1-28-2021-paperwork","status":"publish","type":"post","link":"https:\/\/blogs.pugetsound.edu\/infosec\/the-phish-tank\/257","title":{"rendered":"Phishing from 1\/28\/2021: “PaperWork”"},"content":{"rendered":"\n

Update – 2\/4\/2021<\/em><\/p>\n\n\n\n

Similar phishing message from ppalomar[@]usa[.]edu with subject line “PaperWorks” has been reported. Read further for more information. <\/p>\n\n\n\n

Original Phishing Message<\/p>\n\n\n\n

Note: If you received this email, please simply delete the message. If you clicked on any links, please immediately contact the Service Desk for assistance. Always use caution before clicking links or opening attachments in emails you are not expecting. <\/em><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Where Did the Link Lead?<\/p>\n\n\n\n

The “View Document” hyperlink (https:\/\/docs[.]google[.]com\/uc?export=download&id=1ItMUs2ynoGWJ_5RU2RMmpCUuqpH6UME9<\/em>) does not look immediately suspicious as it leads to docs.google.com. However, you’ll notice that the link contains “=download<\/em>” which triggers an immediate download of the file to your computer. Use caution whenever you see this in a URL. <\/p>\n\n\n\n

The downloaded file was a .html file which would open in your browser like a webpage. It masquerades as a locked PDF file requiring you to sign in to view the document.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Any of the three options to sign in would then open a new dialog window to enter your email address and password. If you click “Login”, your credentials would be immediately sent to the attacker and your account would be compromised. Note: if you entered credentials, please immediately contact the Service Desk for assistance.<\/strong><\/em><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Text of Phishing Message<\/p>\n\n\n\n

From: Ryan.Youell[@]Seattlecolleges[.]edu
Subject: PaperWork<\/p>\n\n\n\n

Attention [username<\/em>]@pugetsound.edu :<\/p>\n\n\n\n

You have a secured and encrypted document waiting for you tagged “PaperWork” by Ryan Youell<\/p>\n\n\n\n

View Document<\/p>\n\n\n\n

Let me know your insights regarding the document. I appreciate your feedback.<\/p>\n\n\n\n

Sincerely,<\/p>\n\n\n\n

Ryan Youell<\/p>\n","protected":false},"excerpt":{"rendered":"

Update – 2\/4\/2021 Similar phishing message from ppalomar[@]usa[.]edu with subject line “PaperWorks” has been reported. Read further for more information. Original Phishing Message Note: If you received this email, please simply delete the message. If you clicked on any links, please immediately contact the Service Desk for assistance. Always use caution before clicking links or […]<\/p>\n","protected":false},"author":521,"featured_media":260,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[3,4],"class_list":["post-257","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-the-phish-tank","tag-phishing","tag-phishtank"],"_links":{"self":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/257","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/users\/521"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/comments?post=257"}],"version-history":[{"count":2,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/257\/revisions"}],"predecessor-version":[{"id":269,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/257\/revisions\/269"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/media\/260"}],"wp:attachment":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/media?parent=257"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/categories?post=257"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/tags?post=257"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}