These Phishers Aren't Even Making an Effort

Help Desk and Outlook are joining forces in a recent phishing scam. Ok, well they aren’t really, but phishers are using both in a scam that is making the rounds right now. However, if you take a few seconds to read the email that is sent from “IT-Service Help Desk,” you can spot the scam. And it does only take a few seconds. As opposed to some more recent sophisticated scams, in this case, the scammers aren’t even really trying.

There have been many warnings of late about how phishers are getting better and better at tricking us into clicking on malicious links and attachments in email, social media, and even text messages. Those warnings are still very valid. However, in a notice to staff and students at the University of Pittsburgh, a sample of a phishing email was included showing that sometimes the old and sloppy ways are still going on. All it takes is to read the greeting to pique suspicion. It starts with “Dear Staffs.”

The link in this email goes to a realistic looking Outlook login page that requests login credentials. Remember that your Outlook login credentials likely don’t just go to your email. Typically, they give you access to other areas of the network or to other accounts. Even if you think there is nothing in your email that is special enough for someone to want, there really is. If a cybercriminal can get your credentials to some server on the network, they can get to critical areas within the network, which is the ultimate goal.

Admittedly, people make mistakes when sending email messages and a greeting could indeed have a typo. Even so, it should cause you to take pause and look a little closer. In the case of this one, the sender asks the recipients to click a link to update their account information by clicking a link. If they don’t, their email accounts will be blocked.

The textbook clues are there: typos, poor grammar and punctuation, and a sense of urgency. Often these days, those simple clues are missing. Some of the signs are the same, but others to look for have changed. Now the biggest indications that it might be phishing are merely that the email itself, a link, or an attachment isn’t expected or you don’t know the sender.

And if you are thinking, “why would anyone target me?” that answer is that they probably aren’t. They are merely taking a stab at a large group of email addresses hoping that someone will take them up on it. Unfortunately, someone likely will. Just be sure it isn’t you.

© Copyright 2017 Stickley on Security