The Phish Tank

Mar. 31st - The Internal Revenue Service issued a warning of an ongoing IRS-impersonation scam that appears to primarily target educational institutions, including students and staff who have ".edu" email addresses. The phishing emails appear to target university and college students from both public and private, profit and non-profit institutions.

The fraudulent email displays the IRS logo and uses various subject lines such as "Tax Refund Payment" or "Recalculation of your tax refund payment." It asks people to click a link and submit a form to claim their refund. 

These are targeted and simple forms of phishing emails designed to get victims to click on a fake Google Forms link that contains malicious content.

These are targeted and simple forms of phishing emails designed to get victims to click on a fake Google Forms link that contains malicious content.

These are targeted and simple forms of phishing emails designed to get victims to interact and establish a rapport. The messages start out as basic greetings or job opportunities and then progress into requests for money or data.

These attacks are a sophisticated, targeted form of phishing emails designed to look like legitimate UC Berkeley IT Client Services emails with the intention of scaring the victim to get them to provide personal information. Legitimate UC Berkeley IT departments will NEVER ask for your passphrase over email.

In ongoing efforts to mitigate the spread of COVID-19, Gov. Newsom launched "California Connected, " the state's contract tracing program and public awareness campaign. Malicious actors are leveraging the program to use phishing scams to exploit the public.

These are targeted and simple forms of phishing emails designed to get victims to purchase gift cards, or to give up personal email or phone numbers. The "email compromise" gets its name because the attacker mimics the email of a known sender. However, these can also be sent through a legitimate, albeit hacked account. The messages start out as basic greetings then progress into requests for money or data. Since the content is highly personalized it’s often easy to get hooked.

These are targeted and simple forms of phishing emails designed to get victims to interact, establish a rapport, and steal money. The messages start out as basic greetings - or job opportunities - and then progress into requests for money or data.

Attackers have been sending emails that feed on concerns about COVID-19 to spread malware, trick them into sharing account credentials, or opening malicious attachments.

This message, appearing to come from a professor, was successful at convincing several students to engage in back and forth emails ending in money changing hands. If you have received this message and shared correspondence with the scammer, we recommend that you cease correspondence immediately and contact UCPD if there has been any financial transactions.

These are targeted and simple forms of phishing emails designed to get victims to purchase gift cards, the "email compromise" gets its name because the attacker mimics the email of a known sender. However, these can also be sent through a legitimate, albeit hacked account. The messages start out as basic greetings then progress into requests for money or data. Since the content is highly personalized it’s often easy to get hooked.

This message, appearing to come from the HR department, was successful at convincing several campus recipients to click on the link provided and enter their Calnet credentials. The link was directed to a fake Calnet login page, the account name and password entered on this page would be compromised.

A recent spate of phishing messages have been received on campus purporting to be Dropbox notifications. The link in the email message to "View File" is a ruse to capture CalNet passphrase credentials.

This was the first tax season related phishing message reported on campus this year. Beware of phishing messages containing fake instructions for downloading your W2 form.

On Dec. 14th, the campus was the target of a phishing email purporting to be from Chancellor Dirks and containing a PDF file attachment with a link to a site intended to steal credentials. Beware of emails with the subject line "Important Announcement from Chancellor B. Dirks".

This phishing message, purportedly from Bank of America, contained multiple threats - two file attachments that likely contain malware and a separate ploy to obtain user credentials.

Another targeted phishing message, this one has been spoofed to appear to come from the Office of the Registrar.

This is an example of how phishing messages can be made to look like they are from a legitimate business, such as PayPal. However, poor grammar and other indicators make this an easy phish to spot.

An email message purporting to be from Apple Support, requesting that the recipient verify their account information, has been seen in several variations on campus.

A targeted phishing message was received at both Berkeley and UCLA campuses that was purportedly from the UC Office of the President requesting an employee's W2 form.

Another example of a common ploy to trick the recipient into clicking a link to a malicious website by claiming access to ITunes has been disabled.

Another example of a phish that attempts to trick the user to click on a link to a malicious website by claiming their password will expire otherwise. This one purports to come from the IT-Service Help Desk.

The 2016 tax filing season is upon us, beware of messages requesting personal information to be updated online to make your "refund easier".

Several people on campus fell for this phish, which directed the recipient to a fake CalNet login page where credentials were stolen. Beware of tax-related phishing exploits, like this one, during this time of year.

This is a forgery example of a commonly used service provider, PayPal. The intent is to fool the recipient into clicking the link directed to a malware infected webpage.