From compromised UMN accounts, forged as from Office of the President, PDF goes to fake login page. Some variation in subject.
From: Office of the President < xxx compromised account firstname.lastname@example.org>
Date: Fri, Jan 27, 2017 at 10:02 AM
Subject: Urgent 72 hrs Email Update (For only Staffs)
University of Minnesota Driven to DiscoverOffice of the President
To protect your email service, you have been required to verify your email by downloading the attached file and login in your email.
Note: There will be restriction to your email if you do not do this within 72 hours.
Thanks for the co-operation.
Eric W. Kaler
This email was sent to faculty, staff and students at the University of Minnesota, Morris by: Office of the President, 202 Morrill Hall, 100 Church St S.E., Minneapolis, MN, 55455, USA. Read our privacy statement.
|PDF with "President" message - links to login form|
|Fake login form linked from "President" PDF|