Go to the U of M home page

Tuesday, August 28, 2018

Example 223: Action Required: University of Minnesota Portal Validation Request

Fake University Login sent from compromised UMN account.

Message Text

From: UMN.EDU Portal < compromised UMN ACCOUNT>
Date: Tue, Aug 28, 2018 at 12:25 PM
Subject: Action Required: University of Minnesota Portal Validation Request


Dear xxxxx@umn.edu,
You are required to verify use of your *UMN.EDU <http://UMN.EDU>* portal
login. This is a routine to delete in-active email from our database.
Verification link expires in *72 hours*.
<http://xxx  xxxxxxx .com/umn-eduWebLoginService/validate.htm>

Failure to complete verification may lead  to restriction of your portal
access. In this case, kindly contact your school IT Administrator.
Thank you
*UMN.EDU <https://www.umn.edu/> Team*
Login Form
 Fake UMN Login webform
Fake UMN Login webform
Things to Note

  • Email DOES come from a UMN.EDU address - a user who had their account stolen
  • Web form copies UMN login page
  • Web form hosted at a ".COM" address, NOT UMN.EDU
  • Login is NOT secure - browser in image above shows the warning.

Wednesday, August 15, 2018

News: Cyberattackers infiltrate Hennepin County workers' e-mails

Cyberattackers have infiltrated e-mail accounts for about 20 Hennepin County employees since late June.

Here's a reminder to be wary of unexpected emails that seem "too good to be true" - often they are neither good nor true:

Star Tribune article about cyber attack
Star Tribune article about cyber attack 


Friday, August 10, 2018

Example 222: Job Job Job!!!


This email scam campaign appears to mostly be directed at students. It is sent by multiple senders with multiple different subject lines, including (but not limited to):

Employment Opportunity For Student Only
Employment Opportunity
New Personal Assistant Needed ( Part-Time Job )
Job Opportunity
School Announcements
University Announcements

There is a Resume.txt file attached, which is only a text file with the phony job offer, not malware.

The scam ends by the scammer asking the student for money to get through customs to come to the United States so he can hire the student.

This is a type of "Money Mule" Scam: http://www.lse.ac.uk/intranet/students/supportServices/healthSafetyWellbeing/MoneyMuleScam.aspx

What you should do: 

  • Report the email as spam in Gmail to help educate Google's spam filters. 
  • Do not engage with the sender.

Content of Resume.txt

Dear Student,
 I am  Dr. Williams Morgan  and I work as a clinical counselor for the department of Disability Resources and Educational Services (DRES). I provide individual and group therapy, coaching, assessment and academic screenings to support students with disabilities (physical, chronic, psychiatric, and invisible)registered with DRES. A large percentage of the students served by the mental health unit have psychiatric disabilities or co-morbid psychiatric disabilities and need mental health support to be successful at the university. In addition,many University of students with academic difficulties and no prior diagnosis are seen and assessed through the academic screening and assessment process. I also am the director of supervision, training and coordination of counseling psychology and clinical psychology graduate students of the United States who have practicums at DRES and APA-accredited school psychology pre-doctoral interns.You have received this email because you have an offer from the University Office for Students with Disabilities to work with me while we help Students with disabilities frustrated with ignorance and lack of services but as my temporary personal assistant. I care about Animal Welfare, Arts and Culture, Children, Civil Rights and Social Action, Education, Environment, Disaster and Humanitarian Relief, Social Services and lots more.This is a very simple employment.

You will only help me Mail letters, Make payments at Walmart and purchase some Items when needed. This employment only takes an hour a day and 3 times a week for $480 weekly.I am unable to meetup for an interview because I am currently away and helping the disabled students in Australia.

You will be paid in advance for all tasks and purchased to be done on my behalf and some of my personal letters and mails will be forwarded to your residence or nearby post office for you to pick up at your convenience. Upon my arrival we will discuss the possibility of making this a long-term employment if I am impressed with your services while I am away. My arrival is scheduled for the 

First week of September 2018

To Apply, Please email your Full name, Address, Alternate email (different from school email) and mobile and  Correspondent will reply you as soon as possible.


Dr Williams Morgan