September 3, 2020
Below is a sophisticated, targeted form of phishing emails designed to look like legitimate UC Berkeley IT Client Services emails with the intention of scaring the victim to get them to provide personal information. Legitimate UC Berkeley IT departments will NEVER ask for your passphrase over email. Do not interact with these emails, instead report it.
Report and/or flag it
To flag it in bMail open the message and next to Reply click the three dots and select "Report phishing".
Things to look for in this attack:
- Notice the "sender's" email is different from the ITCS helpdesk email.
- The campus Duo "migration" occurred in 2018.
- Bad grammar used through out the messages and it is sprinkled with "technical words" that don't actually make sense.
- UC Berkeley IT services and departments will never ask for you for passphrase in an email!
- Notice the threatening language used to scare you into responding.
Original Message:
|
From: nginx user <nginx@mobididong> on behalf of Service at UC Berkeley <itcsshelp@berkeley.edu>
Sent: Wednesday, September 2, 2020 8:22 AM To: xxx Subject: (ITCS Notification:) Account Irregular Activity Detected [INC1147653] UC Berkeley | IT Client Services
Hello, This is an automated official communication from Berkeley IT Client Services Ticket system in reference to the incident number below. Ticket INC1147653 has been created from the recent activities in your CalNet - ID credentials. ITCS system have detected an irregular activity related to your UC Berkeley CalNet ID credentials. As a precautionary measure, we will temporary block your account and should be moving it to our backup server but we need your help to do this effectively otherwise you may lose your login information and data at the end of the Duo Account Migration & Quarantine clean-up process. To regain and secure access to your UC Berkeley CalNet ID credentials, kindly confirm the below requested information to enable us migrate your UC Berkeley CalNet ID credentials to a DUO 2-factor authentication Symantec Endpoint Protection Communication software and register it to a new SPAM filtering service which will improve your Firewall Email Security Overview and the ability to identify and block Spam/Phishing attempts automatically and other undesirable messages that flood our email system on a daily basis. You can resolve your ticket by doing the following: Click on the "reply" button and Confirm your active UC Berkeley CalNet ID credentials; *CalNet ID: *Passphrase: *Email id: Note: We will permanently deactivate and delete your UC Berkeley CalNet ID credentials if you do not adhere to this notice immediately as part of our Inactive ID credentials clean-up process to enable service upgrade efficiency. Thanks, ITCS UC Berkeley IT Client Services Copyright © 2020 University of California, Berkeley. -------------- You received this email because you have submitted a ticket into ServiceNow. University of California • University of California, Berkeley, California, 94720, US |