Example 208: [ATTENTION REQUIRED] University of Minnesota Employee Organizational Internal Communications

Forged mail "from" President Kaler, with a PDF that leads to a fake login page aimed at stealing passwords.

Message Text:

Date:	Fri, 20 Oct 2017 15:45:47 +0000
From:	"Theresa" <txxxxx@xxxxxx>
To:
Subject:	FW:[ATTENTION REQUIRED] University of Minnesota Employee Organizational Internal Communications

FROM THE OFFICE OF THE PRESIDENT
Dear Colleagues,
Integrity has long been a hallmark of our success. It characterizes everything we do. In fact, when we talk about the core values of our company, we start with integrity. Integrity means being straight forward, honest, and transparent in our professional and business relationships. This means doing what we say and saying
what we do.
Each of us makes a wide range of business and ethical decisions every day in the execution of our responsibilities on behalf of University of Minnesota. We are fully committed to ensuring that such decisions comply with the letter and spirit of the law and are ethically above reproach.
This Code of Ethics and Business Conduct is a guide to making the best possible decision in situations affecting your fellow employees or our shareholders, customers, and partners, as well as the communities in which we live and work. In simple terms,  our Code contains the guidelines we must all follow to do business
the only way we should: the right way.

NOTE: It is fundamentally Urgent that all staffs read attached.



ERIC W. KALER
PRESIDENT
University of Minnesota
202 Morrill Hall l 100 Church Street S.E. l Minneapolis l MN l 55455 l USA
Email: upres@umn.edu l Website: www.umn.edu
Phone: 612-626-1616 l Fax: 612-625-3875

PDF content:

PDF with link to fake document

Web Form

Web form to get document - with login to steal credentials

Things to Note:

• Letter forged as "from the President."
• Email delivers a very simple PDF which has one purpose - a link to a login page.
• Login page WILL deliver an innocuous PDF of  a "code of ethics."
• Anyone who filled in the form should immediately change their password.