Unknown senders, will contact faculty posing as real individuals and make specific inquiries regarding their work or publications
The messages could have subject lines similar to any of the following:
The scam may not be a direct malicious threat, but the sender's accounts are fake and the goal is to gather data to use in Large Language Models to enhance AI apps.
Unknown senders, will contact faculty , usually from a @gmail.com address, and offer assistance writing and editing a professional Wikipedia page.
The messages could have subject lines similar to any of the following:
This phony email is allegedly from a UC Berkeley professor, offering a fake internship scam if the applicant would provide additional details.
One of the items they will require is a scan of the applicant's Cal-1 ID card. The Cal-1 card should be handled like any other sensitive document (credit card, driver's license, etc.). You should never be asked to email it to a prospective UCB recruiter.
To the UCB-Security community,
This is a notice from the Information Security Office to alert you to a high severity vulnerability that impacts MongoDB Server [1]. Please share this alert internally with IT admins and service owners who run the product so they are aware and know what actions to take to address this vulnerability.
To the UCB-Security community,
This is a notice from the Information Security Office to alert you to a critical vulnerability that impacts WordPress servers using the Modular DS plugin. Please share this alert internally with IT admins and service owners who run the product so they are aware and know what actions to take to address this vulnerability.
This phony email is allegedly from a campus department regarding new salary details or a financial bonus.
The message will request you follow a link and enter your CalNet username and password, and often personal cell phone number for your new salary or compensation details.
A default setting in bCal may allow anyone from the internet to add you to a Google Calendar invite. This is being used to create fake spam meetings or include potentially malicious links or attachments. Any links included are as dangerous as the ones that would have been included in a phishing email.
The non UC Berkeley senders are sourcing @berkeley.edu email addresses and creating the fake meeting, including subjects like:
This phony Assessment notification was received by many bMail users. It is part of a credential stealing attempt.
The senders email is not a @berkeley.edu email, often a @gmail.com, @outlook.com, or netzero.net account.
This targeted phishing scam uses urgency indicating a task to complete.
The target page below is a non-UC Berkeley Google form. Campus users will never be asked to enter their CalNet credentials in any site other than a UC Berkeley CalNet CAS authentication page.
This fake email is allegedly from a campus member and offers to generously give away musical instruments or sometimes welding tools if only the recipient will pay for shipping.
They will recommend a moving company who will ask you to send money via Zelle, PayPal, or another digital wallet app, wire money, or pay with prepaid debit cards.
Our office has received a number of reports recently of bogus offers for free or discounted convert tickets offered in UCB student platforms (discord, chatgroups, etc.).
July 15, 2025: We are starting to see another wave of phishing attacks designed to steal credentials and reroute UCPath Direct Deposit.
The newest fake emails may reference a pending investigation of misconduct, to which they then ask you to enter your CalNet credentials on a very authentic-looking, but fake, CAS page.
We are seeing a spike in sophisticated tactics used to phish for credentials that are then used in concert with other methods to redirect direct deposit routing in UCPath.
These new tactics involve phishing emails, text messages, and highly accurate - but fake - UCPath websites.
Unknown parties are sending fake Google Doc Shares with an urgent subject line. They usually refer to lawsuits or debt collection.
The bad actor is using the same Google Doc service, so the 'from' email will be the service email (via Google Drive)" <drive-shares-noreply@google.com>. The name of the sender
"Lаthаm & Wаtkins Dеbt ...
"MоrgɑnLеwis© - Suppоrt...
is made to sound official but is fake.
Many bMail account holders have recently received fake messages indicating an ACH Payment or Electronic Fund transfer.
The University of California's Cyber-Risk Coordination Center (C3) published its 2024 Annual Report. The report highlights progress in improving cybersecurity across the university. The insights in the report underscore the UC's commitment to staying ahead of emerging threats and continuously improving its cybersecurity posture.
We’ve made some changes to our network security setup, which will affect how you experience logging into the campus bSecure VPN.
Better security - This new method allows you to use your preferred browser, so outdated browsers like Internet Explorer (which is no longer supported and receiving security patches) won’t be used.
An ineligible former Summer Session student is attempting to contact faculty directly and be added to many bCourses.
In the Spring of 2024, a very similar incident occurred. The messages are usually send from an @gmail.com account, but may come from @berkeley.edu emails.