Example 163: Email Account Update

Fake login warning pointing to a foreign website - Received October 2016

Things to Note:

• Sender is a University member (not any IT office)
• Refers to iCloud - not a University service
• The University (and Google) do not send messages like this.
• See z.umn.edu/whoused to identify (and clear) logins to your account

MESSAGE TEXT:

From: [from compromised account]
Date: Wed, Oct 12, 2016 at 9:04 AMSubject: Email Account UpdateTo: 

Someone else was trying to use your University of Minnesota ID to sign into iCloud via a web browser.
Date and Time: 11 October 2016, 1:38 AMBrowser: FirefoxOperating System: WindowsLocation:Thailand
If the information above looks familiar, you can disregard this email. If you have not recently and believe someone may be trying to access your account, you should click here to upgrade your network
Sincerely,Technical Support Team

FAKE FORM:

Fake, unbranded UMN login (hosted in Iran, not UMN.EDU)