Example 164: Your Pending Emails

Fake umn login on foreign website 

Received October 2016

Things to note

• Email address says it comes "from" purdue.edu (but really sent by compromised UMN user)
• Email text presents a link "at" umn.edu (but really linkied to an Australian website)
• Copy of old UMN login missing "M" logo

Message Text:

From: Purdue University <online @ purdue.edu>
Date: Thu, Oct 20, 2016 at 9:53 AMSubject: Your Pending EmailsTo: 

Dear UMN user,
Please login below to upgrade your mailbox space in order for you to receive your recent pending emails.
http://www.umn.edu/Login <= link to fake login hidden with umn.edu text
Thanks
© 2016 Regents of the University of Minnesota. All rights reserved.     

Fake Login Form

Fake UMN login page - no branding, hosted in Australia