Author Archives: Will

A fake Microsoft OneNote/SharePoint email has been spotted on campus recently, this one did not have the pictures come through correctly, but the one you see may have graphics to lend more credibility to the phishing message. These messages may look real, but if you have not used SharePoint or OneNote by logging & uploading document(s) then the best course of action is to either ignore & delete the phish and/or to log in to the real SharePoint or OneNote site to see if any documents are uploaded on the actual site.

You get an email with a scary sounding subject line informing you that your email account has security flaws & the baylor.edu admin team needs you to kindly click a link to update your account or ALL YOUR EMAIL WILL BE HELD! This type of phish is designed to make you panic, from its official sounding sending address (support@baylor.edu) to the group that supposedly sent the message (baylor.edu admin team) to the threat of stopping all new mail from arriving in your inbox. Usually when an email provides a significant threat & gives you very little time to complete the action, it is not a legitimate email.

So you requested your email account to be deactivated & are now receiving a notice to let you undo that request…wait, what?!?! Current students, faculty, and/or staff may sometimes wish they could deactivate their email (to avoid all the phishes & spam, of course), but there is not a process that allows you to request deactivation & then click a button or link to undo that deactivation request. If you look at the email below, you will also notice that it came from an outside/non-Baylor email address, which should raise some red flags & the screenshot of where the link takes you looks nothing like any Baylor web page you have ever seen. Just another example of phishing, but this one is (hopefully) easy for you to catch & delete!

Screenshot Of Website that loads when you click the phishing link:

Ah yes, the old click here to synchronize your email or you won’t be able to send or receive email & it is mandatory…wait, what?!?! This message may look legit, but this is not something that Baylor ITS will ask you to do. Please observe the philosophy of ‘when in doubt, throw it out’ & delete this message if you receive it.

We are still seeing high numbers of the message unavailable emails with a familiar to you subject line & many users are still clicking the links & giving away their passwords. Please encourage everyone to be careful when clicking links & do not enter your Baylor credentials on any site that you access directly from a link in your email.

This morning we received the following phishing email from a user. It appears to come from Microsoft & warns that you have had abnormal behavior on your email account & if you don’t click the ‘Confirm’ button that you will not receive any new mail. This is a common tactic, designed to get you to panic & without thinking click the link & enter your Baylor account & password. It even says that you should log in with you email & password to confirm & to be sure to do so in a safe & secure manner – this statement is designed to lend legitimacy to the email & to make you relax your guard because the email must be real if it is offering security advice. Also note that it is signed BaylorCorporation…we are not a corporation & even if we were it would likely be 2 separate words.

Let’s all do our part to Sic Phishing on campus to keep our email accounts & our personal information as secure as possible!

Today we saw another phishing message that borrowed a familiar subject line from the email inbox of the person sending the phishing messages…this time they used our BearAware Alert: Active Phishing Event subject line from last week. Please ignore & delete this message if you see it & always be skeptical of emails that look like the examples below this post.

Baylor communications will contain information in the email message & may include instructions on how to access more information online (or web addresses), but they avoid just having a ‘Click here to open this message’ link with no other information. This phishing scheme lends legitimacy to the message by re-using a subject line that the recipient has seen before, probably very recently. It also uses the interlocking BU logo on the page where it asks you to log in while prompting you with your full Baylor email address (yet another trick they use to lend legitimacy to the message).

Remember you can forward any suspected phishing email to BearAware at Baylor dot edu.  As always, Sic Phishing!

As a slight twist on phishing emails we have been seeing for the past couple of weeks, one rolled in this morning with the DocuSign logo at the top. However, this is not from DocuSign & does not contain a document for you to review & sign. If you clicked the link, please change your BearID password immediately.  Remember, you can forward any suspected phishing email to BearAware at Baylor dot edu. #SicPhishing