Example 223: Action Required: University of Minnesota Portal Validation Request

Fake University Login sent from compromised UMN account.

Message Text

From: UMN.EDU Portal < compromised UMN ACCOUNT>
Date: Tue, Aug 28, 2018 at 12:25 PM
Subject: Action Required: University of Minnesota Portal Validation Request
To:

------------------------------
*           UNIVERSITY OF MINNESOTA*



Dear xxxxx@umn.edu,
You are required to verify use of your *UMN.EDU <http://UMN.EDU>* portal
login. This is a routine to delete in-active email from our database.
Verification link expires in *72 hours*.
CLICK HERE TO VERIFY
<http://xxx  xxxxxxx .com/umn-eduWebLoginService/validate.htm>

Failure to complete verification may lead  to restriction of your portal
access. In this case, kindly contact your school IT Administrator.
Thank you
*UMN.EDU <https://www.umn.edu/> Team*

Login Form

Fake UMN Login webform

Things to Note

• Email DOES come from a UMN.EDU address - a user who had their account stolen
• Web form copies UMN login page
• Web form hosted at a ".COM" address, NOT UMN.EDU
• Login is NOT secure - browser in image above shows the warning.