Phishing scam appearing as Microsoft login. Notified Microsoft and webhost.
From: Office365 Message Center <email@example.com> On Behalf Of Exchange Support
Sent: Thursday, March 12, 2020 1:58 PM
Subject: Re: Check Your Payment Information Now.
Your payment has been declined.
Please update your payment information now.
UPDATE YOUR PAYMENT INFORMATION [https://firstname.lastname@example.org]
User ID:*******@ksu.edu [mailto:*******@ksu.edu]
Our records indicate that the payment method you used to purchase Exchange Online was declined.
Please contact your bank for the details on the failed charges.
We appreciate you prompt attention to this matter and look forward to continuing to meet your business needs.
The Microsoft Online Services Team
To avoid service interruption, please update your payment information now. [https://email@example.com]
The Microsoft Online Services Team
Office 365 E1
Payment Account #:
**** **** **** ***0
Sign in [https://firstname.lastname@example.org] to the service portal
Have Questions? Visit the Community. [https://email@example.com]
This message from Microsoft is an important part of a program, service, or product that you or your company purchased or participates in.
One Microsoft Way
Redmond, WA 98052 USA
Phishing Scam with attachment with link in it.
From: Marla Combs <firstname.lastname@example.org>
Sent: Friday, March 20, 2020 1:47 PM
To: ******* <*****@ksu.edu>
Subject: March Reminder for Invoice, from Oracle Softwares
Kindly find in the attachment
Marla Combs, Oracle Softwares
This is a reply-to phishing scam. Microsoft and Google have been notified.
From: ******* <*******@LISTSERV.KSU.EDU> on behalf of Premium Trust Bank <asia-tokyo@ASIA-P.CO.JP>
Sent: Sunday, March 22, 2020, 6:40 AM
Subject: [*******] Attention Beneficiary
PREMIUM TRUST BANK
180 Canal St, New York, [https://www.google.com/maps/search/180+Canal+St,+New+York,+%0D%0A+NY+10013,+United+States?entry=gmail&source=g]
NY 10013, United States [https://www.google.com/maps/search/180+Canal+St,+New+York,+%0D%0A+NY+10013,+United+States?entry=gmail&source=g]
Tel: +1 (646)889-2719
In fight against corruption in the Banking system and in pursuit to re-build a good relationship with the U.S Citizens and the foreigners by the President of the United States of America.
We wish to inform you that every files and reports concerning international payment of all the foreign beneficiaries was brought to my office in the Order and instruction of the U.S Department of States and U.S Department of Treasury.
I must confess that i shared tears after seeing your unclaimed and uncompleted transactions, It was a national slap and a disgrace to this Country after noticing that your have paid for all the fee to receive your fund but your funds never got to your bank account because of the selfish interest of the banks and Individuals mandated to transfer and release your fund to your bank account.
The U.S Department of States and U.S Department of Treasury has approved a compensation payment of US$4,500,000.00 in your name which shall be transfer to your bank account through an online, We will create an online bank in your name and you will transfer your fund by yourself through our online to your bank account.
We chose to transfer your fund through an online banking so that no Agency will notice or stop your fund. Sir, you shall receive this compensation fund within 3 working day, if you comply with our instructions and adhere to our directives.
Get back to us with your information as listed below.
Your Full Name:
Age and Occupation:
Next of Kin:
Scan Copy of your identification
Thank you for your mutual understanding and cooperation as we wait to read from you soonest
Dr. David Nolet
Foreign Remittance Department
Premium Trust Bank
This is a Reply-To phishing scam, with the contents of the email presented as a non-malicious PDF attachment. Google and Microsoft have been notified.
From: Noah Smith <email@example.com>
Sent: Saturday, March 21, 2020 8:59:43 PM
To: ******* ******* <*******@ksu.edu> ******* ******* <*******@ksu.edu> ******* ******* <*******@ksu.edu> ******* ******* <*******@ksu.edu> ******* ******* <*******@ksu.edu> ******* ******* <*******@ksu.edu> ******* ******* <*******@ksu.edu> ******* ******* <*******@ksu.edu> ******* ******* <*******@ksu.edu> ******* ******* <*******@ksu.edu>
Subject: NEW UNIVERSITY JOB OFFER!!!
For More Details See Attached Below
WORK AND STUDY,i am Noah Smith, a current artist and exhibitions major
at Saatchi Gallery, my work subverts the genre of epic historical
painting. Often working from media images, Large-scale paintings
reconstitute current events as timeless fables, spinning the anxiety
of contemporary zeitgeist into overwhelming tableaux of allegorical
fantasy. I am very busy as my interest in this career has developed
around Europe and because of your academic studios and my own work
experience you were selected to work for me as my PA. Please read
below carefully and apply.
I am seeking someone who can handle my customer service maintenance by
shopping, mailing letters and making payment whenever I am
experiencing a high-volume sale or out of country. As my assistant,you
will maintain extensive knowledge of offering a good Walmart or any
art supplies shopping option I give you. If approved to work for me, I
will not be able to meetup right now for an interview due to my
Contemporary Fine Arts exhibition in Berlin, Germany which will be
going on until the end of August. However, I need someone who can
start employment with me right away. This employment only takes an
hour a day and 3 times a week for $450 weekly and This is a real
An advance payment will be made for all purchases and mailing that you
will do for me during your employment time and you are free to resign
respectively if you lose interest in working for me at anytime. This
is a very simple employment. You will only mail Business and personal
letters, purchase small art supplies sold at any nearby stationary
store and make payments on our behalf to suppliers when I am too busy
to do so.
If you are approved. I look forward to meeting you in person upon my
arrival to discuss the opportunity of making this a long-term
employment. In the meantime, I am willing to consider your employment
request if you apply. How do you want your details to appear on all
payments and documents? Please Send Your Full Name, Address, Age,
School Email, Alternate Email and Cell Phone Number for consideration.
Please check provided email 30 minutes after applying for quick response.
This is an email containing a malicious attachment. Google, Microsoft, and the email provider have been notified.
From: firstname.lastname@example.org <email@example.com>
Sent: Friday, March 20, 2020 4:53 PM
To: ******* ******* <*******@ksu.edu>
Reply-to scam. Notified Google.
From: Nancy Ramos
Sent: Thursday, March 19, 2020 7:59 AM
To: ******* <*******@ksu.edu>
Subject: Check out if you can fill the vacant position
Hi, How are you doing.. Your service is needed for a Personal Assistant (Part time) and get paid weekly $425, It’s an home based office work you can be in any location and work with me from your home/school, reply if interested for more description
This is reply to scam where the scammer is pretending to be a department head. Sent to Google abuse.
From: ******* <firstname.lastname@example.org>
Sent: Tuesday, March 17, 2020 12:24 PM
Available, cell phone number?
Associate Professor & Head
Department of *******
The scammer will use an existing random legit message in a compromised account’s inbox (to build credibility) and reply to it urging the receiver to click on the link leading to a one drive containing malware or a phishing scam. The body of the message contains reference to a password to the archive being 7777. We are adding compromised one drive links to this posting.
Here is a form you asked
Password for archive: 7777
Below is an example message the scammer replied to. The scammer can reply to any legit message in a compromised account’s inbox. They do this to build credibility to convince the victim the above scam is real.
>Your eID password will expire on 09/29/2016. You are receiving this email because as of 09/15/2016 02:00 AM the password for eID edeters has not been changed. You must change your password every 180 days.
>If your password is not changed by 09/29/2016, you will LOSE ACCESS to central email, KSIS, K-State Online, limited free printing, university computing labs, and other ITS services. To change your password, sign into Connect by clicking the “Sign in” button from the K-State home page. Once you are on the Connect page, find the eProfile section, click the “Manage password” link and then follow the prompts to change your password. Make sure to enter your cell phone number so you can later recover a forgotten password via text message.
>Once you have changed your password, immediately update the password settings with your new password in all your computers, devices and applications or else risk getting locked out of K-State wireless or email. This includes:
> –KSU Wireless and/or KSU Housing wireless connections
> –Your local email and calendar client such as Outlook, MacMail and iCal, Pegasus, or Gmail
> –Your mobile device(s) such as your cell phone or tablet
>Did you forget your password? Go to Connect by clicking the “Sign in” button from the K-State home page. Click the “Forgot your eID password?” link and follow the prompts to reset your password. You can reset your password by email or by text message.
>STUDENTS and EMPLOYEES: You will need to confirm or make changes to your contact information as part of changing your password.
>Contact us if you need assistance.
>IT Help Desk
>214 Hale Library
>Kansas State University
Reply-to scam. Notified webhost.
Sent: Monday, March 9, 2020 3:25 PM
Subject: Faculty and Staff
Say Goodbye to Student Loans
Hereâ€™s all you need to know about Loan Forgiveness:
What is Public Service Loan Forgiveness (PSLF)?
The PSLF Program promotes full-time public sector employment. All
university and college employees, like educators, may qualify for public
service loan forgiveness for their student loans while working at a college
Call today to find out if you are eligible, it only takes a few minutes:
Educators can get even more through The Teacher Loan Forgiveness Program,
which is intended to encourage individuals to enter and continue in the
teaching profession. Under this program, if you teachfor five consecutive
academic years, you may be eligible for additional forgiveness.
Please note this is only available to educational employees.
Public Service Loan Forgiveness, LLC