UCSF IT Technology

Attackers have launched a series of phishing attacks impersonating reputable secure share providers, which are used for securely sharing files. The lures contain links or attachments containing the supposed document. Interacting with the link or attachment leads to the installation of credential harvesting malicious software (malware). The sending address for the emails does not match the expected company domain for the secure share provider.

Scammers are creating malicious quick response (QR) codes which they are including on official looking forms in public spaces, such as on customer satisfaction surveys outside businesses or on lookalike parking tickets placed on parked cars. The malicious QR codes lead to download sites for malicious third-party applications or lookalike payment websites.

Cybercriminals have launched a campaign distributing malware with an AI-themed lure.  The lure purports to be from an “Information Technology Manager” regarding a mandatory system update for employees.

Cybercriminals have started using the URL shortening service clck[.]ru in widespread phishing attacks in April. The nature of these attacks and the lures used vary greatly. However, the attacks encourage recipients to click on a shortened URL ending in [.]ru.

Threat Alert: What to Watch For

Cybercriminals have launched a series of phishing attacks using a timely tax-themed lure.  The lures imitate the sharing of 2022 tax documents via a Citrix ShareFile link. The lures note that the download expires on April 18, 2023, the tax-filing deadline in the United States.