UCSF IT Technology

Cybercriminals have launched phishing attacks claiming to be senior executives offering employees a Valentine’s Day-themed reward in appreciation of their work.  The message purporting to be from executives might compel users to engage with the supposed employer-related communications.

Cybercriminals have launched a series of phishing attacks using timely tax-themed lures. While the email from field says “Irs notice” and then the name of the organization, the sending address is a Madwire account.The phishing emails contain an HTML attachment allegedly containing delivery details about a tax related USPS letter. Opening the attachment leads to a lookalike Microsoft login page designed to steal credentials.

Cybercriminals have launched a series of phishing attacks using the threat of employee transfers and terminations as a lure. The phishing emails use the subject line "Annual Transfer list & Terminated Employees.”While the email from field says it is from “Human Resources Management Section,” the sending address is a Gmail account. The phishing emails contain a legitimate Dropbox link purporting to lead to a document outlining employee transfers or terminations.

Cybercriminals are abusing Google Ads to have links to malicious web pages appear at the top of Google’s search results as sponsored links. These malicious links are tagged as “Ad” by Google. These web pages are made to imitate the software download pages for popular software utilities and applications.

Recent email-based attacks have abused Microsoft’s legitimate OneNote application to share malicious files. The emails use subject lines like “New Document Shared with you” and encourage the recipient to follow a link to view a shared OneNote file.  The OneNote link leads recipients to a shared document which contains the text “DOUBLE CLICK TO DOWNLOAD THE FILE NOW.”Some attacks may also distribute similar malicious OneNote files as email attachments.

Cybercriminals have launched a series of phishing attacks using timely email phishing lures related to annual compensation reviews and bonuses. The phishing emails encourage recipients to click a lure to confirm a payment-related change.Opening the link leads to a lookalike Microsoft login page, which is designed to steal credentials. The sending email address for the phishing emails is “hrdp” followed by a randomized string of letters and numbers.