Threat Alert: What to Watch For

• Recent email-based attacks have used compromised Microsoft OneDrive accounts to send phishing emails. These emails encourage recipients to click a link to view a shared document.
• The OneDrive links lead targets to shared PDF documents containing quick response (QR) codes. The documents may encourage recipients to scan the codes or rely on users’ tendency to scan them automatically.
• The PDFs hosted on OneDrive have subjects like “Confirm Info,” “Payment instruction,” or “payment.”

Key Action: Report Suspicious Emails

• Report ANY suspicious emails using the Phish Alarm button in your email menu bar.
• Remember: Our organization occasionally sends phishing simulations that are used to evaluate the potential impact of a real phishing attack. Report any emails that match the tactics described above.
• If a reported message is a simulation, you will see a notification alerting you to that. No further action is needed on your part.
• If a reported message was not a simulation, and you are concerned about a time-sensitive request, you must take additional steps to verify the email is valid before acting on it.