Example 208: [ATTENTION REQUIRED] University of Minnesota Employee Organizational Internal Communications

Forged mail "from" President Kaler, with a PDF that leads to a fake login page aimed at stealing passwords.

Message Text:

Date:	Fri, 20 Oct 2017 15:45:47 +0000
From:	"Theresa" <txxxxx@xxxxxx>
To:
Subject:	FW:[ATTENTION REQUIRED] University of Minnesota Employee Organizational Internal Communications

FROM THE OFFICE OF THE PRESIDENT
Dear Colleagues,
Integrity has long been a hallmark of our success. It characterizes everything we do. In fact, when we talk about the core values of our company, we start with integrity. Integrity means being straight forward, honest, and transparent in our professional and business relationships. This means doing what we say and saying
what we do.
Each of us makes a wide range of business and ethical decisions every day in the execution of our responsibilities on behalf of University of Minnesota. We are fully committed to ensuring that such decisions comply with the letter and spirit of the law and are ethically above reproach.
This Code of Ethics and Business Conduct is a guide to making the best possible decision in situations affecting your fellow employees or our shareholders, customers, and partners, as well as the communities in which we live and work. In simple terms,  our Code contains the guidelines we must all follow to do business
the only way we should: the right way.

NOTE: It is fundamentally Urgent that all staffs read attached.



ERIC W. KALER
PRESIDENT
University of Minnesota
202 Morrill Hall l 100 Church Street S.E. l Minneapolis l MN l 55455 l USA
Email: upres@umn.edu l Website: www.umn.edu
Phone: 612-626-1616 l Fax: 612-625-3875

PDF content:

PDF with link to fake document

Web Form

Web form to get document - with login to steal credentials

Things to Note:

• Letter forged as "from the President."
• Email delivers a very simple PDF which has one purpose - a link to a login page.
• Login page WILL deliver an innocuous PDF of  a "code of ethics."
• Anyone who filled in the form should immediately change their password.

Example 207: You have an Important message to review

Fake health message email directs to a forged UMN login site in Russia

Message Text:

 From: UMN - Health Care <xxxx @ Some-other-school.edu>
 Subject: You have an Important message to review
 Date: October 2, 2017 at 1:58:48 PM CDT
 To:
 You have an important Health message from University of Minnesota Health Center. Click  Here
      hxxp:// news-xxxxx.ru/login.umn.edu/
  authentication is required to read this message
  We apologize for any inconvenience.
 Thank You.. 
 Allen Brianna
 Health Care Center
 University of Minnesota

Login Form:

Russian hosted forged umn login site

Things to Note:

• URL for login is hosted at a Russian (.ru) hosted site.
• There is no "Allen Brianna" at the University
• Filling in the form redirects to https://www.health.umn.edu/our-impact/health-care-reform, a real UMN website (about health care) which REQUIRES NO AUTHENTICATION.