Example 175: Scanned document(s) attached

PDF from compromised user, goes to fake Google login

Received December 2016

Things to note

• Email comes from a compromised umn.edu user's account
• Attached PDF contains a link to a fake website
• Filling in page redirects to real Google Drive 

Message:

From: Xxxxxx Yyyyyy <xyyyy  @  umn.edu>Date: Thu, Dec 15, 2016 at 12:05 PMSubject: Scanned document(s) attachedTo: 

I have shared a document for your review, please find it below.
Best Regards,

Xxxxxx Yyyyyyy

PDF with link

dummy PDF with link to login form

Fake Login Form

Bogus Google login (note multiple email providers named)