Example 181: Urgent 72 hrs Email Update (For only Staffs)

From compromised UMN accounts, forged as from Office of the President, PDF goes to fake login page. Some variation in subject. 

Message Text

From: Office of the President < xxx compromised account xxx@umn.edu>
Date: Fri, Jan 27, 2017 at 10:02 AM
Subject: Urgent 72 hrs Email Update (For only Staffs)
To:

University of Minnesota Driven to DiscoverOffice of the President
 Dear Staffs,
 To protect your email service, you have been required to verify your email by downloading the attached file and login in your email.
 Note: There will be restriction to your email if you do not do this within 72 hours.
 Thanks for the co-operation.
 Eric W. Kaler
 President
This email was sent to faculty, staff and students at the University of Minnesota, Morris by: Office of the President, 202 Morrill Hall, 100 Church St S.E., Minneapolis, MN, 55455, USA. Read our privacy statement.

PDF attached

PDF with "President" message - links to login form

Login Form Linked

Fake login form linked from "President" PDF