Kansas State University

search

Scams

Category: Phishing Scams

Scam emails specifically targeting user credentials on K-State systems – like email.

Phishing Scam – 04/01/20 – Your Microsoft billing statement is ready.

Phishing Scam

From: Exchange Update <flight_notification@bangkokair.com>
Sent: Wednesday, April 01, 2020 5:18 PM
To: ******* <*******@ksu.edu>
Subject: Your Microsoft billing statement is ready.
Your payment has been declined.
Please update your payment information now.
UPDATE YOUR PAYMENT INFORMATION [https://‌admin.appi‌.pt‌/ExchangeUpdate/index.php?m=********@ksu.edu]
User ID: *********@ksu.edu [mailto:********@ksu.edu]
Our records indicate that the payment method you used to purchase Exchange Online was declined.
We appreciate you prompt attention to this matter and look forward to continuing to meet your business needs.
Sincerely,
The Microsoft Online Services Team
Sign into your admin account [https://‌admin.appi‌.pt‌/ExchangeUpdate/index.php?m=*******@ksu.edu] To Pay your Invoice
Thank you,
The Microsoft Online Services Team
Account Information
Service:
Office 365 E3
Payment Account #:
**** **** **** ***5
Helpful Resources
Sign in [https://‌admin.appi‌.pt‌/ExchangeUpdate/index.php?m=********@ksu.edu] to the service portal
Have Questions? Visit the Community. [https://‌admin.appi‌.pt‌/ExchangeUpdate/index.php?m=*******@ksu.edu]
This message from Microsoft is an important part of a program, service, or product that you or your company purchased or participates in.
Privacy Statement
MicrosoftCorporation
One Microsoft Way
Redmond, WA 98052 USA
[Auto Reply]
Thank you for your email, we appreciate the opportunity to serve your requirement, we strive to respond to all emails as soon as possible.
Any urgent case, please contact our Call Center on 1771 (local contact) or +66 (2) 270 6699 (24 hours).
Please note that the office hours of email correspondence is as follows:
Monday – Friday: 08.00-18.30 hours
Saturday – Sunday and Public Holidays: 08.00 -17.30 hours
Thailand local time (GMT +7)
Kindly be noted that the personal details given in this will be used for the purpose of handling your request via the email correspondence and will be stored as long as it is required for future improvement of our service. Such data provided may require to be transferred or forwarded to an authorized third-party partner for the purpose in managing your request. You have the right to correct of any your personal data held by us.  For full details of our Privacy Policy, please visit the “Legal Notice” section on our website at http://www.bangkokair.com/eng/about-us/legal-notice [http://www.bangkokair.com/eng/about-us/legal-notice] .
In addition, you confirm that you have read and understood Bangkok Airways Privacy Policy and consent to the collection, processing, use, storage, access, contacting and transfer of your personal data as described in the “Privacy Policy” at http://www.bangkokair.com/eng/privacy-policy [http://www.bangkokair.com/eng/privacy-policy] .
***** Note: This message was sent automatically, please do not reply*****
Best Regards,
Bangkok Airways
Asia’s Boutique Airline
[อีเมลตอบกลับอัตโนมัติ]
เรียน ท่านผู้โดยสาร
ขอบคุณสำหรับการติดต่อมาที่บางกอกแอร์เวย์ส ข้อความนี้เป็นการยืนยันว่าบางกอกแอร์เวย์ส ได้รับอีเมลของท่านแล้ว ทางเรามีความยินดีเป็นอย่างยิ่งที่ได้มีโอกาสให้บริการท่าน เราจะพยายามที่จะติดต่อกลับหาท่านโดยเร็ว
สำหรับกรณีเร่งด่วนสามารถติดต่อผ่าน Call Center ที่หมายเลข 1771 (สำหรับภายในประเทศเท่านั้น) หรือ +66 (2) 270 6699 (ตลอด 24 ชั่วโมง)
ขอเรียนให้ทราบถึงเวลาทำการของส่วนตอบรับอีเมล ดังนี้
จันทร์ – ศุกร์: 08.00 – 18.30 น.
วันเสาร์ – อาทิตย์ วันหยุดราชการ และวันหยุดนักขัตฤกษ์: 08.00 – 17.30 น.
ตามเวลาประเทศไทย (GMT +7)
นอกจากนี้ ข้อมูลส่วนตัวที่ท่านให้ไว้ในอีเมลล์ฉบับนี้จะถูกนำไปใช้เพื่อบริหารการนำส่งการตอบรับจากท่าน และข้อมูลจะถูกจัดเก็บไว้นานเท่าที่จำเป็นสำหรับใช้ในการพัฒนาบริการของเรา ซึ่งข้อมูลดังกล่าวอาจมีความจำเป็นที่จะต้องถูกส่งต่อไปยังพันธมิตรคู่สัญญาเพื่อจัดการการตอบรับจากท่าน ทั้งนี้ท่านมีสิทธิ์ที่จะแจ้งเปลี่ยนแปลงข้อมูลที่อยู่กับเราได้ทุกเมื่อ ท่านสามารถดูรายละเอียดฉบับเต็มเกี่ยวกับนโยบายความเป็นส่วนตัว ได้ที่ส่วน “เกี่ยวกับด้านกฏหมาย” บนหน้าเว็บไซต์ของเรา หรือ คลิ๊กที่ http://www.bangkokair.com/tha/about-us/legal-notice [http://www.bangkokair.com/tha/about-us/legal-notice]
ท่านยืนยันว่าได้อ่านและทำความเข้าใจเกี่ยวกับเนื้อหานโยบายความเป็นส่วนตัวของบางกอกแอร์เวย์ส และยินยอมให้ทำการเก็บ จัดเก็บ ประมวล ใช้ เข้าใช้ ถ่ายโอนข้อมูลความเป็นส่วนตัวดังที่ระบุใน “นโยบายความเป็นส่วนตัว” หรือ คลิ๊กที่ http://www.bangkokair.com/tha/privacy-policy [http://www.bangkokair.com/tha/privacy-policy]
***ข้อความนี้เป็นระบบตอบรับอัตโนมัติ กรุณาอย่าตอบกลับ***
ขอแสดงความนับถือ
Bangkok Airways
Asia’s Boutique Airline
[—001:002615:11636–

Phishing Scam – 03/12/2020 – Check Your Payment Information Now.

Phishing scam appearing as Microsoft login. Notified Microsoft and webhost.

From: Office365 Message Center <office365@highelmsmanorschool.com> On Behalf Of Exchange Support
Sent: Thursday, March 12, 2020 1:58 PM
To: aqmith@aol.com
Subject: Re: Check Your Payment Information Now.
Your payment has been declined.
Please update your payment information now.
UPDATE YOUR PAYMENT INFORMATION [https://‌collegeballs‌.com‌/exch/2/index.php?m=georgewm@ksu.edu]
User ID:*******@ksu.edu [mailto:*******@ksu.edu]
Our records indicate that the payment method you used to purchase Exchange Online was declined.
Please contact your bank for the details on the failed charges.
We appreciate you prompt attention to this matter and look forward to continuing to meet your business needs.
Sincerely,
The Microsoft Online Services Team
To avoid service interruption, please update your payment information now. [https://‌collegeballs‌.com‌/exch/2/index.php?m=georgewm@ksu.edu]
Thank you,
The Microsoft Online Services Team
Account Information
Service:
Office 365 E1
Payment Account #:
**** **** **** ***0
Helpful Resources
Sign in [https://‌collegeballs‌.com‌/exch/2/index.php?m=*******@ksu.edu] to the service portal
Have Questions? Visit the Community. [https://‌collegeballs‌.com‌/exch/2/index.php?m=*******@ksu.edu]
This message from Microsoft is an important part of a program, service, or product that you or your company purchased or participates in.
MicrosoftCorporation
One Microsoft Way
Redmond, WA 98052 USA

Phishing Scam – 03/22/2020 – Attention Beneficiary

This is a reply-to phishing scam. Microsoft and Google have been notified.

From: ******* &lt*******@LISTSERV.KSU.EDU&gt on behalf of Premium Trust Bank &ltasia-tokyo@ASIA-P.CO.JP&gt
Sent: Sunday, March 22, 2020, 6:40 AM
To: *******@listserv.ksu.edu
Subject: [*******] Attention Beneficiary
PREMIUM TRUST BANK
180 Canal St, New York, [https://www.google.com/maps/search/180+Canal+St,+New+York,+%0D%0A+NY+10013,+United+States?entry=gmail&source=g]
NY 10013, United States [https://www.google.com/maps/search/180+Canal+St,+New+York,+%0D%0A+NY+10013,+United+States?entry=gmail&source=g]
Swift: PTBLBXXX
Tel: +1 (646)889-2719
==============================================
 Attention Beneficiary,
 In fight against corruption in the Banking system and in pursuit to re-build a good relationship with the U.S Citizens and the foreigners by the President of the United States of America.
 We wish to inform you that every files and reports concerning international payment of all the foreign beneficiaries was brought to my office in the Order and instruction of the U.S Department of States and U.S Department of Treasury.
I must confess that i shared tears after seeing your unclaimed and uncompleted transactions, It was a national slap and a disgrace to this Country after noticing that your have paid for all the fee to receive your fund but your funds never got to your bank account because of the selfish interest of the banks and Individuals mandated to transfer and release your fund to your bank account.
The U.S Department of States and U.S Department of Treasury has approved a compensation payment of US$4,500,000.00 in your name which shall be transfer to your bank account through an online, We will create an online bank in your name and you will transfer your fund by yourself through our online to your bank account.
We chose to transfer your fund through an online banking so that no Agency will notice or stop your fund. Sir, you shall receive this compensation fund within 3 working day, if you comply with our instructions and adhere to our directives.
 Get back to us with your information as listed below.
Your Full Name:
Address:
Phone number:
Age and Occupation:
Next of Kin:
Scan Copy of your identification
 Thank you for your mutual understanding and cooperation as we wait to read from you soonest
 Yours Faithfully,
Dr. David Nolet
Foreign Remittance Department
Premium Trust Bank

Phishing Scam – 03/21/2020 – NEW UNIVERSITY JOB OFFER!!!

This is a Reply-To phishing scam, with the contents of the email presented as a non-malicious PDF attachment. Google and Microsoft have been notified.

From: Noah Smith &ltmarysmith616463@gmail.com&gt
Sent: Saturday, March 21, 2020 8:59:43 PM
To: ******* ******* &lt*******@ksu.edu> ******* ******* &lt*******@ksu.edu> ******* ******* &lt*******@ksu.edu> ******* ******* &lt*******@ksu.edu> ******* ******* &lt*******@ksu.edu> ******* ******* &lt*******@ksu.edu> ******* ******* &lt*******@ksu.edu> ******* ******* &lt*******@ksu.edu> ******* ******* &lt*******@ksu.edu> ******* ******* &lt*******@ksu.edu&gt
Subject: NEW UNIVERSITY JOB OFFER!!!
 —
For More Details See Attached Below

(Attachment)

Hello Student,
WORK AND STUDY,i am Noah Smith, a current artist and exhibitions major
at Saatchi Gallery, my work subverts the genre of epic historical
painting. Often working from media images, Large-scale paintings
reconstitute current events as timeless fables, spinning the anxiety
of contemporary zeitgeist into overwhelming tableaux of allegorical
fantasy. I am very busy as my interest in this career has developed
around Europe and because of your academic studios and my own work
experience you were selected to work for me as my PA. Please read
below carefully and apply.
I am seeking someone who can handle my customer service maintenance by
shopping, mailing letters and making payment whenever I am
experiencing a high-volume sale or out of country. As my assistant,you
will maintain extensive knowledge of offering a good Walmart or any
art supplies shopping option I give you. If approved to work for me, I
will not be able to meetup right now for an interview due to my
Contemporary Fine Arts exhibition in Berlin, Germany which will be
going on until the end of August. However, I need someone who can
start employment with me right away. This employment only takes an
hour a day and 3 times a week for $450 weekly and This is a real
employment.
An advance payment will be made for all purchases and mailing that you
will do for me during your employment time and you are free to resign
respectively if you lose interest in working for me at anytime. This
is a very simple employment. You will only mail Business and personal
letters, purchase small art supplies sold at any nearby stationary
store and make payments on our behalf to suppliers when I am too busy
to do so.
If you are approved. I look forward to meeting you in person upon my
arrival to discuss the opportunity of making this a long-term
employment. In the meantime, I am willing to consider your employment
request if you apply. How do you want your details to appear on all
payments and documents? Please Send Your Full Name, Address, Age,
School Email, Alternate Email and Cell Phone Number for consideration.
Please check provided email 30 minutes after applying for quick response.

Phishing Scam – 03/19/2020 – Check out if you can fill the vacant position

Reply-to scam. Notified Google.

From: Nancy Ramos
Sent: Thursday, March 19, 2020 7:59 AM
To: ******* <*******@ksu.edu>
Subject: Check out if you can fill the vacant position
 Hi, How are you doing.. Your service is needed for a Personal Assistant (Part time) and get paid weekly $425, It’s an home based office work you can be in any location and work with me from your home/school, reply if interested for more description
Regards,
Nancy Ramos

Phishing Scam – 03/16/20 – Viewing Your Paycheck and Other Important Information

Phishing scam.

From:***** <******@ksu.edu>
Sent: Monday, March 16, 2020 4:11 PM
To: HCS Welcome
Subject: Re: Viewing Your Paycheck and Other Important Information
Here is a form you asked
https://drive.google.com/uc?id=15ujnVtLWAsGSlljGW21SG9rVtHE1bVKD&export=download [https://drive.google.com/uc?id=15ujnVtLWAsGSlljGW21SG9rVtHE1bVKD&export=download]
Password for archive: 7777