Threat Alert: What to Watch For

• Cybercriminals have launched series of phishing attacks claiming to be from the recipient’s HR department.
• The lures use a variety of sender names like HR Alerts or HR Department; however, the actual sending address is not associated with a recipient’s company or HR department.
• The lures typically direct the recipient to take immediate action regarding an HR assignment or alert by clicking on a malicious link leading to the download of a zipped .url file or downloading a PDF attachment. 
• The lures used in these attacks typically have notable grammatical or syntactical errors. 

Key Action: Report Suspicious Emails

• Report ANY suspicious emails using the Phish Alarm button in your email menu bar. 
• Remember: Our organization occasionally sends phishing simulations that are used to evaluate the potential impact of a real phishing attack. Report any emails that match the tactics described above. 
• If a reported message is a simulation, you will see a notification alerting you to that. No further action is needed on your part. 
• If a reported message was not a simulation, and you are concerned about a time-sensitive request, you must take additional steps to verify the email is valid before acting on it. 

Tips to Remember (at Work and at Home)

• Beware of strong appears to emotion. Cybercriminals look for ways to increase pressure on recipients of phishing emails. Threats of HR warnings or alerts regarding issues related to payroll are intended to increase the chances of interaction with malicious attachments or URLs. 
• Remain alert to phishing indicators. Mismatches between sending addresses and an organization’s name are always warning signs. Obvious spelling mistakes or grammatical errors should also be treated as grounds for suspicion.  
• Verify the legitimacy of any unsolicited/unexpected email before you interact with it, especially if it directs you to click on a link or download a file. It can be tempting to click on a “call-to-action.” But if you notice a subtle change or inconsistency within a message claiming to be from HR or another internal department, don’t ignore it—report it.