UCSF IT Technology

Microsoft announced Windows 10 Home and Pro, Version 21H2 will reach end of service June 13, 2023. The software will no longer receive security updates after June 13, 2023For a complete description of the vulnerabilities and affected systems go to Windows 10 Home and Pro, Version 21H2.IT SecurityRead more about IT Security service offerings.

Cybercriminals have launched phishing attacks using apparently compromised SAP Concur and DocuSign accounts to distribute malicious emails.  The phishing lures use financial themes, such as an expense report on SAP Concur or a financial settlement document on DocuSign. The lures include malicious links.

Cybercriminals have launched phishing attacks using lures that impersonate Microsoft Teams meeting invites. The lures include a malicious link.  Clicking the malicious link leads to a credential phishing kit that redirects the user to a legitimate login page.

The US Federal Trade Commission has warned of AI-enhanced voice phishing (vishing) calls impersonating loved ones in distress. The calls use an AI system to create a believable clone of a loved one’s voice based off publicly accessible voice samples on platforms like YouTube, TikTok, or Instagram. The impersonated individual will claim to be in distress and ask for financial assistance, usually in the form of a wire transfer, cryptocurrency, or specific gift cards.

Scammers are creating fake customer support Twitter accounts for various banks and financial institutions. Scammer use these fake accounts to respond to users who tweet questions at their banks or financial institutions. The fake customer support accounts direct users to call an attacker-controlled phone number. These fake accounts may bear very similar names to the actual, legitimate financial institution. However, these accounts will not have the verified checkmark.

Following the collapse of Silicon Valley Bank (SVB), cybercriminals have launched phishing attacks to take advantage of the high-profile event.One widespread lure impersonates Circle, the peer-to-peer payments company that manages the cryptocurrency USDC. The lure encourages recipients to click an offer link to redeem a one-to-one exchange between the cryptocurrency USDC and the U.S.

Cybercriminals have launched phishing attacks using malicious invoice-themed attachments to spread malicious software (malware).The phishing attacks hijack legitimate email threads to deliver the phishing lures to further increase the believability of the attacks. This means the lures may appear to be response to previous, legitimate email conversations.The malicious attachments used in this campaign are extremely large, zipped Microsoft Word files.