{"id":537,"date":"2021-12-17T12:25:20","date_gmt":"2021-12-17T20:25:20","guid":{"rendered":"https:\/\/blogs.pugetsound.edu\/infosec\/?p=537"},"modified":"2021-12-17T12:29:27","modified_gmt":"2021-12-17T20:29:27","slug":"phishing-from-12-17-2021-contracts-settlements-plans","status":"publish","type":"post","link":"https:\/\/blogs.pugetsound.edu\/infosec\/the-phish-tank\/537","title":{"rendered":"Phishing from 12\/17\/2021: &#8220;CONTRACTS SETTLEMENTS PLANS&#8221;"},"content":{"rendered":"\n<p class=\"has-large-font-size\">Original Phishing Message<\/p>\n\n\n\n<p><strong><em>NOTE: If you received this message, please delete it as it is NOT legitimate and do not click the l<\/em><\/strong>ink. If you entered <strong><em>credentials on the linked webpage, please contact the Service Desk immediately as your credentials are likely compromised. <\/em><\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"461\" src=\"https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/12\/12-17-21-contracts-phish-1024x461.png\" alt=\"\" class=\"wp-image-538\" srcset=\"https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/12\/12-17-21-contracts-phish-1024x461.png 1024w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/12\/12-17-21-contracts-phish-300x135.png 300w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/12\/12-17-21-contracts-phish-768x346.png 768w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/12\/12-17-21-contracts-phish.png 1183w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"has-large-font-size\">Tips for Detection<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Note the caution banner prepended to the message. Emails that match patterns of other phishing attempts will have this maroon banner.<\/li><li>Always hover over links before clicking them to determine if they lead to trusted sites. <\/li><li>Use caution when replying, clicking links, or opening attachments when receiving unexpected emails. If you know the individual but the email feels off, reach out to them via an alternate means of contact. <\/li><\/ul>\n\n\n\n<p class=\"has-large-font-size\">Where did the Link Lead?<\/p>\n\n\n\n<p>The link led to a phishing site l5z55k[.]axshare[.]com designed to appear like a document sharing page. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"491\" src=\"https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/12\/12-17-21-contracts-phish-pdf-1024x491.png\" alt=\"\" class=\"wp-image-539\" srcset=\"https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/12\/12-17-21-contracts-phish-pdf-1024x491.png 1024w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/12\/12-17-21-contracts-phish-pdf-300x144.png 300w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/12\/12-17-21-contracts-phish-pdf-768x368.png 768w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/12\/12-17-21-contracts-phish-pdf-1536x736.png 1536w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/12\/12-17-21-contracts-phish-pdf-1440x690.png 1440w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/12\/12-17-21-contracts-phish-pdf.png 1736w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>When attempting to view the PDF, it would prompt you for credentials impersonating the Microsoft login page. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"528\" src=\"https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/12\/12-17-21-contracts-phish-login-prompt-1024x528.png\" alt=\"\" class=\"wp-image-540\" srcset=\"https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/12\/12-17-21-contracts-phish-login-prompt-1024x528.png 1024w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/12\/12-17-21-contracts-phish-login-prompt-300x155.png 300w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/12\/12-17-21-contracts-phish-login-prompt-768x396.png 768w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/12\/12-17-21-contracts-phish-login-prompt-1536x791.png 1536w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/12\/12-17-21-contracts-phish-login-prompt-1440x742.png 1440w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2021\/12\/12-17-21-contracts-phish-login-prompt.png 1749w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"has-large-font-size\">Text of Phishing Message<\/p>\n\n\n\n<p>From: michael[@]osstherapy[.]com<br>Subject: CONTRACTS SETTLEMENTS PLANS<\/p>\n\n\n\n<p>Hello,<\/p>\n\n\n\n<p>Good morning. I hope you are well?<\/p>\n\n\n\n<p>Please review below and kindly get back to me.<\/p>\n\n\n\n<p>CONTRACTS SETTLEMENTS PLANS.PDF [<em>link removed<\/em>]<\/p>\n\n\n\n<p>Thanks<\/p>\n\n\n\n<p>Michael<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Original Phishing Message NOTE: If you received this message, please delete it as it is NOT legitimate and do not click the link. If you entered credentials on the linked webpage, please contact the Service Desk immediately as your credentials are likely compromised. Tips for Detection Note the caution banner prepended to the message. Emails [&hellip;]<\/p>\n","protected":false},"author":521,"featured_media":538,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[3],"class_list":["post-537","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-the-phish-tank","tag-phishing"],"_links":{"self":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/537","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/users\/521"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/comments?post=537"}],"version-history":[{"count":2,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/537\/revisions"}],"predecessor-version":[{"id":543,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/537\/revisions\/543"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/media\/538"}],"wp:attachment":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/media?parent=537"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/categories?post=537"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/tags?post=537"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}