Example 172: Upgrade

Fake UMN warning from compromised user
Received November 2016

Things to note

• Email comes a compromised umn.edu user's account
• Link to "UMN" goes to a .com site
• Copied UMN login page warns about going to non-umn sites - like their own page
• Filling in page redirect to UMN TC home page
• University email storage is UNLIMITED - there is no "15 GB" limit.

Message Text:

From: University Of Minnesota <compromised user @ umn.edu>
Date: Fri, Nov 18, 2016 at 9:39 AM
Subject: Upgrade
To:
Dear UMN user,
Your Email space is about to be used up. Please upgrade to 15GB mailbox
space below so that you can receive your new pending emails.

http://umn.edu/login
<http:// xxxx xxxx.com/unm/Sign%20In_%20University%20of%20Minnesota.html>

Fake Login Form

fake UMN login - note: includes warning about going to fake sites