Example 211: myU maintenance

Well crafted email "from" morris.umn.edu, linked to forged UMN login site aimed at stealing user id and password.

Message text

From: University of Minnesota Morris [forged as from Morris]
Date: 2018-01-14 20:17 GMT-06:00Subject: myU maintenanceTo: xxxx@morris.umn.edu 

We are carrying out a system upgrade, as a result inactive Student INTERNET IDs and Students mail will be removed from our servers during this Upgrade. All Students are required to go to MyU [link to offshore .GA website] Student portal and click OK to acknowledge your account usage or risk loosing access to University Services.

If you encounter any problems accessing your account and for additional assistance with your  INTERNET ID, please send a mail to ummonestop@morris.umn.edu or call 320-589-6046.

ONE STOP STUDENT SERVICES
105 Behmler Hall
600 E 4th StreetMorris, MN 56267-2132
8:00 a.m. - 4:30 p.m., Monday-Friday

We apologize for any inconveniences

Thank you.

Please note: IT Service Desk and the system office will never ask you for your password. If you receive any request for your password, please delete it immediately without a reply.

 Web form

Forged UMN Login page - hosted offshore

Things to note:

• Hidden link in emal text for "MyU" goes to a website hosted at a .ga (Gabon) site, NOT umn.edu
• All contact info in the fake mail IS correct - you can call or email to confirm; if you did you'd learn this was a scam
• If you ever receive such messages and question them - send them to phishing@umn.edu for our team to investigate