Kansas State University

search

Scams

Month: April 2020

Phishing Scam – 04/29/20 – Quick Request

Impersonating reply-to scam.

From: Tim de Noble <tdenoble.kstate@gmail.com>
Sent: Wednesday, April 29, 2020 3:27 PM
To: ******
Subject: Quick Request
Can you give me your available text number that i can reach you at ?

Professor & Dean Office of the Dean College of Architecture, Planning & Design 2132 Regnier Hall Manhattan, KS 66506 Kansas State University

Phishing Scam – 04/28/2020 – Quick Request

Reply-To Scam. Notified Google.

From: Kevin P. Gwinner <kgwinner.ksu@gmail.com>
Sent: Tuesday, April 28, 2020 4:40 PM
To: ********
Subject: Quick Request
Can you give me your available text number that i can reach you at ? 

Edgerley Family Dean of the College of Business Administration
Professor

Department of Marketing
*******
Manhattan, KS 66506
Kansas State University

Phishing Scam – 04/24/20 – **Daily message report**

Phishing Scam.

From: Ksu – <silentcodersyear@avcomm.cloud>
Sent: Friday, April 24, 2020 3:18 PM
To: ********* <******@ksu.edu>
Subject: **Daily message report**
 This is preheader text. Some clients will show this text as a preview.
О3009f3097f4028і9626с4086е16635094324626516154885
(3747Ѕ2654у7414ѕ7367t6091е3202m56286671М5772е4834ѕ2279ѕ5725а8257g4877е9502)5631
D1255е3274а9798r74709065********2434:35443646
64184896
7697013033753369240576074900h5331а9699ѕ94172002р5471r4251е3171v1196е2508n6937t9587е7029d70822861t6827h4553е19278524d4010е3911l9848і6444v6446е6266r1340у41446459о7762f33844066826627605n3765е2079w84978125е5220m1668а8211і6618l7495ѕ77993648t4578о95509364у8021о1478u7889r20314278і7737n7364b9614о4004х75943758
9352а5356ѕ60323418о6907f36386073(7876Friday, April 24, 20205558)83781802b1591е1797с7599а4118u6760ѕ5476е51429848і7462t67242259і6066d5802е1359n7207t8347і8899f7713і8914е7917d61091512t1214h2242е9253ѕ3014е12695700m7462е8537ѕ6392ѕ7942а9223g3991е2060ѕ59838357а6091ѕ58325819ѕ2816р6981а1885m7508.72297982
5856Ү6128о5695u47704046с1804а5171n41492936r4425е6053v3094і9014е3515w16315407t1457h9744е8288ѕ2406е57286645h7387е1560r2464е90927430а3238n6601d46601220с2457h9678о5805о6116ѕ3724е64991288w6763h8324а4603t28161419h3618а5220р1940р7914е5567n1684ѕ62026862t6302о28474250t6751h4201е3343m4182.6329
R8833е7731v6438і1290е7409w22446296М1134е7633ѕ6473ѕ6787а5958g9966е8492ѕ6266 [https://las-vegas-extended-stay.biz-stay.com/?action=directory_city.hst&url=https://awuoiscq.com/wey/gits/********@ksu.edu&cid=250&cspid=29&rgid=1&hid=1412706&p=1&ai=116180]
R3584е3713g7096а1498r8170d7669ѕ6590,5032
©15153795277460923721527041859416М7826і5318с5712r7849о2951ѕ2186о4636f7798t21523129С4065о4626r5732р1161о5014r3902а7720t1604і7824о1692n8820.59961305А1348l6400l39897983r5638і4405g2168h5054t2231ѕ63769656r8970е8217ѕ1842е3607r6016v2884е5625d8970.

Reply to Phishing Scam – Kansas State University Announcements Job Internship Opportunity For Studen

Reply to scam.

From: Wellinghoff, Alyssa M <alyssa.wellinghoff@siu.edu>
Sent: Thursday, April 23, 2020 5:36:06 PM
>
Subject: Kansas State University Announcements Job Internship Opportunity For Student Prog 2020
CLICK NOTEPAD ATTACHED FOR INTERNSHIP DETAILS

Hi Student,
I am Dr Martin Abramson's, I feel comfortable discussing this WORK- STUDY opening with you since you were referred by the university chamber of commerce. I am very busy that is why i have asked for your help as my temporary personal assistant. I provide individual and group therapy, coaching, assessment and many University of students with academic difficulties and no prior diagnosis are seen and assessed through the academic screening and assessment process. 
You have received this email because you have an offer from the University Office to help Students with Disabilities to work with me while we help Students with disabilities frustrated with ignorance and lack of services but as my temporary personal assistant
This is a very simple employment, You will only help me Mail letters, Make payments at retail stores and purchase some Items when needed. This employment only takes an hour a day and 3 times a week for $450 weekly. I am unable to meetup for an interview because I am currently away and helping the disabled students in Australia.
You will be paid in advance for all tasks and purchased to be done on my behalf and some of my personal letters and mails will be forwarded to your residence or nearby post office for you to pick up at your convenience. Upon my arrival we will discuss the possibility of making this a long-term employment if I am impressed with your services while I am away. My arrival is scheduled for the last week of April  2020.
Please email your Full name, Residential Address to receive packages, Alternate email (different from school email) and Cell # 


Clinical Counselor
Disability Resources and Educational Services(DRES)


You are required to fill the below details
Full Name: 
Full address: 
City: 
State: 
Zip code: 
Age: 
Mobile Phone number: 
Alternative email (different from school email): 
 Attached Resume( Its okay if you do not have resume to attach). Please its highly important that you reply and send above information to my personal email address (randykelly001@gmail.com) so i can respond back to you immediately.         


Warmest regards 
Dr Martin Abramson's

Phishing Scam – 04/22/2020 – [Subject is a password]

Reply-To bitcoin scam. Scammer claims to have incriminating material to blackmail victim into sending money. The password was likely harvested from an insecure website and is used to build credibility. Since many of these are coming in, we have listed all of the bitcoin addresses the scammer may be using here. We have notified Microsoft.

𝙸𝚝 𝚜𝚎𝚎𝚖𝚜 𝚝𝚑𝚊𝚝, *******, 𝚒𝚜 𝚢𝚘𝚞𝚛 𝚙𝚊𝚜𝚜𝚠𝚘𝚛𝚍.
𝙸 𝚗𝚎𝚎𝚍 𝚢𝚘𝚞𝚛 𝟷𝟶𝟶% 𝚊𝚝𝚝𝚎𝚗𝚝𝚒𝚘𝚗 𝚏𝚘𝚛 𝚝𝚑𝚎 𝚞𝚙𝚌𝚘𝚖𝚒𝚗𝚐 𝚃𝚠𝚎𝚗𝚝𝚢-𝚏𝚘𝚞𝚛 𝚑𝚛𝚜, 𝚘𝚛 𝙸 𝚖𝚊𝚢 𝚖𝚊𝚔𝚎 𝚜𝚞𝚛𝚎 𝚢𝚘𝚞 𝚝𝚑𝚊𝚝 𝚢𝚘𝚞 𝚕𝚒𝚟𝚎 𝚘𝚞𝚝 𝚘𝚏 𝚜𝚑𝚊𝚖𝚎 𝚏𝚘𝚛 𝚝𝚑𝚎 𝚛𝚎𝚜𝚝 𝚘𝚏 𝚢𝚘𝚞𝚛 𝚕𝚒𝚏𝚎 𝚜𝚙𝚊𝚗.
𝙷𝚎𝚕𝚕𝚘, 𝚢𝚘𝚞 𝚍𝚘𝚗’𝚝 𝚔𝚗𝚘𝚠 𝚖𝚎. 𝙱𝚞𝚝 𝙸 𝚔𝚗𝚘𝚠 𝚙𝚛𝚎𝚝𝚝𝚢 𝚖𝚞𝚌𝚑 𝚎𝚟𝚎𝚛𝚢𝚝𝚑𝚒𝚗𝚐 𝚌𝚘𝚗𝚌𝚎𝚛𝚗𝚒𝚗𝚐 𝚢𝚘𝚞. 𝚈𝚘𝚞𝚛 𝚌𝚞𝚛𝚛𝚎𝚗𝚝 𝚏𝚊𝚌𝚎𝚋𝚘𝚘𝚔 𝚌𝚘𝚗𝚝𝚊𝚌𝚝 𝚕𝚒𝚜𝚝, 𝚙𝚑𝚘𝚗𝚎 𝚌𝚘𝚗𝚝𝚊𝚌𝚝𝚜 𝚊𝚜 𝚠𝚎𝚕𝚕 𝚊𝚜 𝚊𝚕𝚕 𝚝𝚑𝚎 𝚍𝚒𝚐𝚒𝚝𝚊𝚕 𝚊𝚌𝚝𝚒𝚟𝚒𝚝𝚢 𝚘𝚗 𝚢𝚘𝚞𝚛 𝚌𝚘𝚖𝚙𝚞𝚝𝚎𝚛 𝚏𝚛𝚘𝚖 𝚙𝚛𝚎𝚟𝚒𝚘𝚞𝚜 𝟷𝟼𝟷 𝚍𝚊𝚢𝚜.
𝙲𝚘𝚗𝚜𝚒𝚜𝚝𝚒𝚗𝚐 𝚘𝚏, 𝚢𝚘𝚞𝚛 𝚜𝚎𝚕𝚏 𝚙𝚕𝚎𝚊𝚜𝚞𝚛𝚎 𝚟𝚒𝚍𝚎𝚘 𝚏𝚘𝚘𝚝𝚊𝚐𝚎, 𝚠𝚑𝚒𝚌𝚑 𝚋𝚛𝚒𝚗𝚐𝚜 𝚖𝚎 𝚝𝚘 𝚝𝚑𝚎 𝚙𝚛𝚒𝚖𝚊𝚛𝚢 𝚖𝚘𝚝𝚒𝚟𝚎 𝚠𝚑𝚢 𝙸 ‘𝚖 𝚌𝚘𝚖𝚙𝚘𝚜𝚒𝚗𝚐 𝚝𝚑𝚒𝚜 𝚜𝚙𝚎𝚌𝚒𝚏𝚒𝚌 𝚎 𝚖𝚊𝚒𝚕 𝚝𝚘 𝚢𝚘𝚞.
𝚆𝚎𝚕𝚕 𝚝𝚑𝚎 𝚕𝚊𝚜𝚝 𝚝𝚒𝚖𝚎 𝚢𝚘𝚞 𝚟𝚒𝚜𝚒𝚝𝚎𝚍 𝚝𝚑𝚎 𝚜𝚎𝚡𝚞𝚊𝚕𝚕𝚢 𝚐𝚛𝚊𝚙𝚑𝚒𝚌 𝚠𝚎𝚋𝚙𝚊𝚐𝚎𝚜, 𝚖𝚢 𝚜𝚙𝚢𝚠𝚊𝚛𝚎 𝚎𝚗𝚍𝚎𝚍 𝚞𝚙 𝚋𝚎𝚒𝚗𝚐 𝚊𝚌𝚝𝚒𝚟𝚊𝚝𝚎𝚍 𝚒𝚗𝚜𝚒𝚍𝚎 𝚢𝚘𝚞𝚛 𝚙𝚎𝚛𝚜𝚘𝚗𝚊𝚕 𝚌𝚘𝚖𝚙𝚞𝚝𝚎𝚛 𝚠𝚑𝚒𝚌𝚑 𝚎𝚗𝚍𝚎𝚍 𝚞𝚙 𝚍𝚘𝚌𝚞𝚖𝚎𝚗𝚝𝚒𝚗𝚐 𝚊 𝚋𝚎𝚊𝚞𝚝𝚒𝚏𝚞𝚕 𝚏𝚘𝚘𝚝𝚊𝚐𝚎 𝚘𝚏 𝚢𝚘𝚞𝚛 𝚖𝚊𝚜𝚝𝚞𝚛𝚋𝚊𝚝𝚒𝚘𝚗 𝚊𝚌𝚝 𝚋𝚢 𝚝𝚛𝚒𝚐𝚐𝚎𝚛𝚒𝚗𝚐 𝚢𝚘𝚞𝚛 𝚠𝚎𝚋 𝚌𝚊𝚖𝚎𝚛𝚊.
(𝚢𝚘𝚞 𝚐𝚘𝚝 𝚊 𝚛𝚎𝚊𝚕𝚕𝚢 𝚠𝚎𝚒𝚛𝚍 𝚝𝚊𝚜𝚝𝚎 𝚋𝚝𝚠 𝚕𝚖𝚏𝚊𝚘)
𝙸 𝚑𝚊𝚟𝚎 𝚐𝚘𝚝 𝚝𝚑𝚎 𝚏𝚞𝚕𝚕 𝚛𝚎𝚌𝚘𝚛𝚍𝚒𝚗𝚐. 𝙸𝚏 𝚙𝚎𝚛𝚑𝚊𝚙𝚜 𝚢𝚘𝚞 𝚝𝚑𝚒𝚗𝚔 𝙸 𝚊𝚖 𝚏𝚘𝚘𝚕𝚒𝚗𝚐 𝚊𝚛𝚘𝚞𝚗𝚍, 𝚓𝚞𝚜𝚝 𝚛𝚎𝚙𝚕𝚢 𝚙𝚛𝚘𝚘𝚏 𝚊𝚗𝚍 𝙸 𝚠𝚒𝚕𝚕 𝚋𝚎 𝚏𝚘𝚛𝚠𝚊𝚛𝚍𝚒𝚗𝚐 𝚝𝚑𝚎 𝚛𝚎𝚌𝚘𝚛𝚍𝚒𝚗𝚐 𝚛𝚊𝚗𝚍𝚘𝚖𝚕𝚢 𝚝𝚘 𝟹 𝚙𝚎𝚘𝚙𝚕𝚎 𝚢𝚘𝚞 𝚛𝚎𝚌𝚘𝚐𝚗𝚒𝚣𝚎.
𝙸𝚝 𝚖𝚒𝚐𝚑𝚝 𝚋𝚎 𝚢𝚘𝚞𝚛 𝚏𝚛𝚒𝚎𝚗𝚍, 𝚌𝚘 𝚠𝚘𝚛𝚔𝚎𝚛𝚜, 𝚋𝚘𝚜𝚜, 𝚖𝚘𝚝𝚑𝚎𝚛 𝚊𝚗𝚍 𝚏𝚊𝚝𝚑𝚎𝚛 (𝙸 𝚍𝚘𝚗’𝚝 𝚔𝚗𝚘𝚠! 𝙼𝚢 𝚜𝚢𝚜𝚝𝚎𝚖 𝚠𝚒𝚕𝚕 𝚛𝚊𝚗𝚍𝚘𝚖𝚕𝚢 𝚙𝚒𝚌𝚔 𝚝𝚑𝚎 𝚌𝚘𝚗𝚝𝚊𝚌𝚝𝚜).
𝚆𝚒𝚕𝚕 𝚢𝚘𝚞 𝚋𝚎 𝚌𝚊𝚙𝚊𝚋𝚕𝚎 𝚝𝚘 𝚐𝚊𝚣𝚎 𝚒𝚗𝚝𝚘 𝚊𝚗𝚢𝚘𝚗𝚎’𝚜 𝚎𝚢𝚎𝚜 𝚊𝚐𝚊𝚒𝚗 𝚊𝚏𝚝𝚎𝚛 𝚒𝚝? 𝙸 𝚚𝚞𝚎𝚜𝚝𝚒𝚘𝚗 𝚝𝚑𝚊𝚝…
𝙽𝚘𝚗𝚎𝚝𝚑𝚎𝚕𝚎𝚜𝚜, 𝚍𝚘𝚎𝚜𝚗’𝚝 𝚗𝚎𝚌𝚎𝚜𝚜𝚊𝚛𝚒𝚕𝚢 𝚑𝚊𝚟𝚎 𝚝𝚘 𝚋𝚎 𝚝𝚑𝚊𝚝 𝚙𝚊𝚝𝚑.
𝙸 𝚠𝚘𝚞𝚕𝚍 𝚕𝚒𝚔𝚎 𝚝𝚘 𝚖𝚊𝚔𝚎 𝚢𝚘𝚞 𝚊 𝟷 𝚝𝚒𝚖𝚎, 𝚗𝚘 𝚗𝚎𝚐𝚘𝚝𝚒𝚊𝚋𝚕𝚎 𝚘𝚏𝚏𝚎𝚛.
𝙿𝚞𝚛𝚌𝚑𝚊𝚜𝚎 $ 𝟸𝟶𝟶𝟶 𝚒𝚗 𝚋𝚒𝚝𝚌𝚘𝚒𝚗 𝚊𝚗𝚍 𝚜𝚎𝚗𝚍 𝚒𝚝 𝚘𝚗 𝚝𝚑𝚎 𝚍𝚘𝚠𝚗 𝚋𝚎𝚕𝚘𝚠 𝚊𝚍𝚍𝚛𝚎𝚜𝚜:

  • 1K7PCCJjsZ3wTAvyXuZtDrqQ8GBbDh*ZdhZ
  • 137tx2AhwRbt3faMxbBpWQ*agycXB9LHHpe
  • 15f7n3Y38*MQoBhUhSxCbDnZ13TrbFjzmdG
  • 1Fnt*y1b55Dm6XBMzqJUeC3PT4iqGGAvxRZ
  • 1P5q43VvpNaKaUrV1hmsX4jYVwcZWAZ*8ke
  • 1LxfQxMa12raX7*C5kDaX8vE4cWYoSuNC8p
  • 1M5yA91ifKdW4rBEG17vtkAUt5Q*NwJpCah
  • 14Uy8yUS9zgjH8JUoMWt45qGY2*NNXBhtDM
  • 1AdQkVXQVyR4qvLQpa9gbQoweUwB9eez*r6
  • 1q5J8*3A7szwXMH1TiNvnuj7e9QW5WPpLW
  • 19NTqWyC8tDnKcQM8H9xGmuPAFX*dRGEzW1

[𝙲𝙰𝚂𝙴 𝚜𝚎𝚗𝚜𝚒𝚝𝚒𝚟𝚎 𝚌𝚘𝚙𝚢 & 𝚙𝚊𝚜𝚝𝚎 𝚒𝚝, 𝚊𝚗𝚍 𝚛𝚎𝚖𝚘𝚟𝚎 * 𝚏𝚛𝚘𝚖 𝚒𝚝]
(𝙸𝚏 𝚢𝚘𝚞 𝚍𝚘 𝚗𝚘𝚝 𝚔𝚗𝚘𝚠 𝚑𝚘𝚠, 𝚕𝚘𝚘𝚔 𝚘𝚗𝚕𝚒𝚗𝚎 𝚑𝚘𝚠 𝚝𝚘 𝚙𝚞𝚛𝚌𝚑𝚊𝚜𝚎 𝚋𝚒𝚝𝚌𝚘𝚒𝚗. 𝙳𝚘 𝚗𝚘𝚝 𝚠𝚊𝚜𝚝𝚎 𝚖𝚢 𝚙𝚛𝚎𝚌𝚒𝚘𝚞𝚜 𝚝𝚒𝚖𝚎)
𝙸𝚏 𝚢𝚘𝚞 𝚜𝚎𝚗𝚍 𝚝𝚑𝚒𝚜 ‘𝚍𝚘𝚗𝚊𝚝𝚒𝚘𝚗’ (𝚠𝚑𝚢 𝚍𝚘𝚗’𝚝 𝚠𝚎 𝚌𝚊𝚕𝚕 𝚒𝚝 𝚝𝚑𝚊𝚝?). 𝙰𝚏𝚝𝚎𝚛 𝚝𝚑𝚊𝚝, 𝙸 𝚠𝚒𝚕𝚕 𝚍𝚒𝚜𝚊𝚙𝚙𝚎𝚊𝚛 𝚊𝚗𝚍 𝚗𝚎𝚟𝚎𝚛 𝚐𝚎𝚝 𝚒𝚗 𝚝𝚘𝚞𝚌𝚑 𝚠𝚒𝚝𝚑 𝚢𝚘𝚞 𝚊𝚐𝚊𝚒𝚗. 𝙸 𝚠𝚒𝚕𝚕 𝚎𝚛𝚊𝚜𝚎 𝚎𝚟𝚎𝚛𝚢𝚝𝚑𝚒𝚗𝚐 𝙸 𝚑𝚊𝚟𝚎 𝚒𝚗 𝚛𝚎𝚕𝚊𝚝𝚒𝚘𝚗 𝚝𝚘 𝚢𝚘𝚞. 𝚈𝚘𝚞 𝚖𝚊𝚢 𝚟𝚎𝚛𝚢 𝚠𝚎𝚕𝚕 𝚌𝚊𝚛𝚛𝚢 𝚘𝚗 𝚕𝚒𝚟𝚒𝚗𝚐 𝚢𝚘𝚞𝚛 𝚌𝚞𝚛𝚛𝚎𝚗𝚝 𝚘𝚛𝚍𝚒𝚗𝚊𝚛𝚢 𝚍𝚊𝚢 𝚝𝚘 𝚍𝚊𝚢 𝚕𝚒𝚏𝚎 𝚠𝚒𝚝𝚑 𝚗𝚘 𝚌𝚘𝚗𝚌𝚎𝚛𝚗.
𝚈𝚘𝚞’𝚟𝚎 𝟷 𝚍𝚊𝚢 𝚝𝚘 𝚍𝚘 𝚜𝚘. 𝚈𝚘𝚞𝚛 𝚝𝚒𝚖𝚎 𝚠𝚒𝚕𝚕 𝚜𝚝𝚊𝚛𝚝 𝚊𝚜 𝚜𝚘𝚘𝚗 𝚢𝚘𝚞 𝚌𝚑𝚎𝚌𝚔 𝚘𝚞𝚝 𝚝𝚑𝚒𝚜 𝚎 𝚖𝚊𝚒𝚕. 𝙸 𝚑𝚊𝚟𝚎 𝚊𝚗 𝚜𝚙𝚎𝚌𝚒𝚊𝚕 𝚌𝚘𝚍𝚎 𝚝𝚑𝚊𝚝 𝚠𝚒𝚕𝚕 𝚗𝚘𝚝𝚒𝚏𝚢 𝚖𝚎 𝚊𝚜 𝚜𝚘𝚘𝚗 𝚊𝚜 𝚢𝚘𝚞 𝚐𝚘 𝚝𝚑𝚛𝚘𝚞𝚐𝚑 𝚝𝚑𝚒𝚜 𝚖𝚊𝚒𝚕 𝚜𝚘 𝚍𝚘 𝚗𝚘𝚝 𝚊𝚝𝚝𝚎𝚖𝚙𝚝 𝚝𝚘 𝚙𝚕𝚊𝚢 𝚜𝚖𝚊𝚛𝚝.

Phishing Scam – 04/16/2020 – Re: [Reply to some item in the compromised user’s inbox]

This is a Google drive baiting type of scam. An email in the compromised user’s account is replied to with the addition of information to a Google drive containing malware or strategies for stealing credentials.  Each email will contain a unique Google drive address.  We will add them to this post.

From: “*******@LISTSERV.KSU.EDU [mailto:*******@LISTSERV.KSU.EDU]” <*******@ksu.edu [mailto:*******@ksu.edu]>
Subject: Re: [EDADVISING] EVERY: Advisor Hold
Date: April 16, 2020 at 5:26:31 PM CDT
To: *******@KSU.EDU [mailto:*******@KSU.EDU]

The information that is added to the original email:

The contract has been updated, please check.
https://drive.google.com/uc?id=1pdS3_ZyqGgRCztxnn0rrvNStYv_kLoxs&export=download [https://drive.google.com/uc?id=1pdS3_ZyqGgRCztxnn0rrvNStYv_kLoxs&export=download]
Archive password: 7777

or

  • https://drive.google.com/uc?id=1u7Q-BfCT_Yy8mXu9mKo2UgeGkKJAlC4E&export=download
  • https://drive.google.com/uc?id=1QGECsqrHhPpw4exZkBHw4RxsY6sGQui8&export=download
  • https://drive.google.com/uc?id=1u7Q-BfCT_Yy8mXu9mKo2UgeGkKJAlC4E&export=download
  • https://drive.google.com/uc?id=1kLAaPjXibWTB08lJN02jtPv9D8JAKCNG&export=download
  • https://drive.google.com/uc?id=1bAZxYT81JEnW5C0zu7facsDw_cCXF4Gg&export=download

Example of original email which can be any item in the compromised user’s inbox:

After the first week of every semester, KSIS puts an Advisor Hold on your account . This hold prevents you from dropping or adding a class for Fall 2017 without talking with your Advisor.  If you are not planning to drop or add any courses this semester, ignore the hold.