Warning: spear-phishing campaign targeting IS MU login credentials
The Cybersecurity Team of Masaryk University warns of an ongoing spear-phishing campaign aimed at stealing login credentials for the Masaryk University Information System.
Warning: fraudulent email will probably be in your inbox too
The Cybersecurity Team of Masaryk University found a higher threat of phishing attacks, which aim to trick and manipulate users into behaving as the attacker demands. Therefore, we urge all Masaryk University users to be vigilant and cautious.
What is it about?
During a phishing attack, the attacker usually pretends to be a trusted person or institution and uses manipulation (urgency or time pressure) to make the victim do something for them - send them information, install malware, or click on a link in an email that leads to a fake website.
This website usually contains fraudulent web forms to enter login credentials, credit card numbers, and other sensitive information.
Attackers often use sophisticated techniques to make their scam resemble reality as close as possible, making phishing challenging to identify.
Phishing emails are extremely dangerous. They can easily disguise themselves as regular emails, increasing the risk of users clicking
on fraudulent links unnoticed or providing sensitive information without realizing it is a scam.
What can phishing look like?
From: MUNI HR muni. humanresources@gmail.com
Sent: Wednesday, April 19, 2023 1:24 PM
Subject: Addendum to the employment contract - notice of the missing statement
Hello,
We have not yet received your statement on whether the forthcoming amendment to your employment contract is correct. Please note that the deadline for sending feedback ends tomorrow. Proposals sent after this date will not be incorporated.
You can find the current form of the addendum here.
Please send your comments in response to this email.
Best Regards
Mgr. et Mgr. Veronika Novotna
HR specialist – MU Human Resources Department
So how not to be manipulated and what to look out for?
Email headers
The email's sender may be similar to a legitimate organization's name and email address (e.g., a banking institution) but, in reality, differs, for example, by a slightly modified name or domain. In the case of our university environment, we may see headers similar to
inet-mt@ics.munl.cz instead of the official inet-mt@ics.muni.cz (use of small "L" instead of "i" in the domain @ics.muni.cz).
What to do?
It is necessary to check the sender's address and any slight change in the domain name (such as using the letter "v" instead of "u", etc.).
The body of the email
It is essential to check the content of phishing emails, which may contain URL links to unknown websites and requests for sensitive information such as login details and credit card numbers. Attackers can create false urgency in emails (e.g., data loss threats) to pressure users into acting quickly without giving them time to think critically.
What to do?
While these emails may seem trustworthy at first glance, it is essential to remember that a legitimate authority (e.g., a bank
or university) will never request sensitive information, such as a password, via email. Critically evaluate the content of the email and the website to which it is linked. Watch out for unusual text with typos, garbled phrases, and nonsensical salutations. Also, make sure that the links lead to legitimate websites and that the URL is the one you want to visit.
Email footer
The logos placed in the emails' footer are often misused to give the impression that it is an official email. When users see the logo of an institution they know and trust, they are less cautious and may be more prone to entering sensitive information without realizing it is an attack.
What to do?
When receiving emails from unknown senders, it is vital to be cautious. Don't be fooled by seemingly credible elements. If in doubt about their authenticity, do not click on the links. Instead, contact the institution or sender directly to verify the email's authenticity.
Be aware also of a more sophisticated variant of phishing called spear-phishing. It is an attack during which the attacker collects information about individuals or groups and creates customized fraudulent emails to make them as credible as possible. Attackers most often obtain information about the target from publicly available sources. While this attack is not as common, it is a very dangerous way of obtaining information and data from users. Therefore, be especially cautious when email communications involve important data, monetary amounts, etc.
Efficient protection against phishing attacks that try to steal your access data is provided by multi-factor authentication. Especially effective is its variant using a security key. You can find the instructions on how to implement this authentication method on your devices on IT MU. Another essential aspect of phishing protection involves utilizing a password manager. Password manager offer secure, encrypted password management and safeguard your accounts. Additionally, they simplify your daily routine by eliminating the need to recall multiple passwords.
Take-home message
Attacking a human is cheaper, faster, and overall easier than trying to do the same with sophisticated security technologies. That's why our team is constantly creating educational content to help you behave more securely in cyberspace. If you do happen to be a victim of attackers, or if you just suspect a phishing email, don't hesitate to contact the Cybersecurity Team of Masaryk University, which is there for you.