Example 184: Email Urgent Update

Forged "Office of President" email, from compromised UMN account; PDF attachment redirects to a fake Google login.

MESSAGE TEXT

From: Office of the President < xxx compromised accoun xxx@umn.edu>
Subject: Email Urgent Update
Date: January 30, 2017 at 1:29:24 PM CST
To: undisclosed-recipients:;
University of Minnesota Driven to DiscoverOffice of the President

 Dear Staffs,
 To protect your email service, you have been required to verify your email by downloading the attached file and login in your email.
 Note: There will be restriction to your email if you do not do this within 72 hours.
 Thanks for the co-operation.
 Eric W. Kaler
 President

This email was sent to faculty, staff and students at the University of Minnesota, Morris by: Office of the President, 202 Morrill Hall, 100 Church St S.E., Minneapolis, MN, 55455, USA. Read our privacy statement.

PDF attached

PDF with "President" message - links to login form

Login Form Linked

Fake login form linked from "President" PDF