Kansas State University

search

Scams

Phishing Scam – 09/10/2020 – Important task

This is a reply-to phishing scam. The sender impersonates a Dean of a department to receive a response. The responsible e-mail addresses were reported to the appropriate channels.

From: ********* <*********@gmail.com>
Sent: Thursday, September 10, 2020 1:31 PM
To: ********* <*********@ksu.edu>
Subject: Important task
Busy?

Dean
College of arts and sciences

Phishing Scam – 09/08/2020 – Duplicate Account(s) Match.

This is a phishing scam with a malicious link. The goal of this scam is to harvest credentials using the link in the email. Microsoft, Google, and other relevant web hosts have been notified.

From: ajpheart@msubmit.net
Sent: Tuesday, September 8, 2020 7:16 PM
To: ******* ******* <*******@ksu.edu>
Subject: Duplicate Account(s) Match.
 Dear Prof. *******,
In an effort to remove duplicate accounts from our submission system, we are contacting those who may
have duplicate accounts based on certain matching criteria. We currently have two accounts in our
system with the following matching information:
First Name: Thomas
Last Name: *******
Organization: Kansas State University
List of duplicate accounts:
*******@*****.edu
If you believe the accounts are yours, please click the link below and specify which email address
should be marked as duplicate or not duplicate, please indicate an answer for all matching accounts.
Please then log into the account of the above email address and click on the link in the corresponding
account to verify ownership and specify which email address should be usd as the primary email address.
Once both links are clicked, we will automatically combine your two accounts.
https://ajpheart.msubmit.net/cgi-bin/main.plex?el=A6DA4BdC4A1BLQu1Bj3A1DhfF9ftdtGo5o0C1YGq66fAqnZYr6wZ [https://ajpheart.msubmit.net/cgi-bin/main.plex?el=A6DA4BdC4A1BLQu1Bj3A1DhfF9ftdtGo5o0C1YGq66fAqnZYr6wZ]
Sincerely,
American Journal of Physiology-Heart and Circulatory Physiology
Duplicate Account(s) Match.
ajpheart@msubmit.net
Tue 9/8/2020 7:16 PM

Phishing Scam – 09/07/2020 – Service Report Notifications **1 file attached ** : 9/7/2020

This scam has an attachment named [eID]@ksu.edu-Incoming-files-[DateTime].hTM. The file is encoded using Unescape. Decoded it reveals a script that navigates the user to what Google has identified as a deceptive site: https://wthink.it/opp/?alphine1=eID@ksu.edu We have blocked it at the border, notified the webhost, and reported to Microsoft anti-phishing.

From: ksu.edu Document Services <linda@tefrainc.com>
Sent: Monday, September 7, 2020 8:01 AM
To: *******;
Subject: Service Report Notifications **1 file attached ** : 9/7/2020
Hello *******,
Preview attachment for This months Statement.ksu.edu
From ksu.edu Documents 2020.

Phishing Scam – 09/08/2020 – WORK

This is a reply-to phishing scam. The email lists the description of a job along with the information needed to receive a position. The email recipients consists of a long list of emails from random universities including K-State affiliates. The responsible e-mail addresses were reported to the appropriate channels.

From: ********* <*********@gmail.com>
Sent: Tuesday, September 8, 2020 10:57 AM
To: ********* <*********@ksu.edu>; ********* <*********@ksu.edu>; ********* <*********@ksu.edu>; *********@gmail.com <*********@gmail.com>; *********@gmail.com <*********@gmail.com>; *********@sru.edu <*********@sru.edu>; *********@psu.edu <*********@psu.edu>; *********@ucsc.edu <*********@ucsc.edu>; *********@oberlin.edu <*********@oberlin.edu>; *********@gmail.com <*********@gmail.com>; ********* <*********@ksu.edu>; *********@ucsc.edu <*********@ucsc.edu>; *********@g.ucla.edu <*********@g.ucla.edu>; ********* <*********@ksu.edu>; ********* <*********@ksu.edu>; ********* <*********@ksu.edu>; *********@ucsc.edu <*********@ucsc.edu>; *********@ucsc.edu <*********@ucsc.edu>
Subject: WORK
Hello,
I am *********, from Vista Print Inc, I’m extremely in need of your assistance in your geographical location, Our Company has been on the internet for networking to seek people who are responsible and ambitious to gain part of the part-time position I’m offering.
We are in need of someone who will only Initiate Suppliers payment, Tracking Raw Materials, and supplies (online) to ensure on-time delivery of Products to Bookstores, Libraries/customers when needed, This employment takes 2 hours a day and 3 times a week for $350.00 weekly ( You will be paid in advance for all tasks and purchases to be done as a company representative).
This position doesn’t cost you any money to start with and all expenses needed will be provided by me, if interested kindly get back with the details requested below and I will get back to you with more details and we shall proceed on working together.
NAME:
CONTACT ADDRESS (NOT PO BOX):
CITY:
STATE:
ZIPCODE:
MOBILE:
D.O.B:
GENDER:
ALTERNATIVE EMAIL:
Please ignore if not interested. Thanks for your understanding.
Warm Regards.
Vista Print Inc

Reply-To Scams – 09/05/2020 – “Follow up”, “Urgent follow up”

Reply-To Scams. There are a rash of reply-to scams where the sender has created a non-ksu email account, usually with Google, containing in the username portion the person they are impersonating. The person who is being impersonated is typically a person of authority such as department heads, deans, supervisors, etc. The scammer ties to engage the victim in conversation.  The scammer then tries to exploit the role of the person of authority and the victim by asking/telling/ordering the victim to purchase a cash card and to send the cash card numbers to the impersonator.  The motivation behind this attack is to steal your  money by convincing the victim to just give it to them.

A list of scammer email addresses associated with this scam:

    • macro.ksu.edu@gmail.com
    • jbmorris.k.state.edu@gmail.com
    • cmaguilera.ksu.edu@gmail.com

From: Dr. Melinda A. Cro <macro.ksu.edu@gmail.com [mailto:macro.ksu.edu@gmail.com]>
Sent: Saturday, September 5, 2020 7:30 AM
To: ******* <*******@ksu.edu [mailto:*******@ksu.edu]>
Subject: Follow up
Hello *******,
How are you doing? Are you available for a quick task?
Best regards
Melinda Cro.

Department Head & Associate Professor

Phishing Scam – 09/04/2020 – Favor…(Recipient’s Name)

This is a reply-to phishing scam. The subject line contains the name of the recipient along with the word ‘Favor…’. The responsible e-mail addresses were reported to the appropriate channels.

From: ********* <*********@hotmail.com [mailto:*********@hotmail.com]>
Sent: Friday, September 04, 2020 3:53 PM
Subject: Favor…*********
Hi,
I hope this mail finds you well, I need your favor please.
Thanks
*********
*********@hotmail.com [mailto:*********@hotmail.com]

Phishing Scam – 09/04/2020 – Merchant Account Review

This is a reply-to type of phishing scam where the person is impersonating someone of power to get financial gain from the users. The responsible e-mail addresses were reported to the appropriate channels.

Good Afternoon ,
As you’re aware, we are dealing with unprecedented challenges due to the Coronavirus outbreak. We are trying to protect our health, and the health of our loved ones and our community. We’re also trying to continue to serve our clients, who will ultimately need us now more than ever.
Serve First Solutions is proud to announce that we will now be offering reduced pricing, guaranteed rates for the lifetime of your account, as well as waiving all set-up fees for new accounts.
To get started – simply reply with your most recent Merchant Services Statement and we’ll get to work on a no-cost, no-obligation savings analysis.   
We know this time is difficult and we’re proud to have the opportunity to partner with you.  From our family to yours, please be safe. Thank you for your consideration.
Best regards, 
************* | Account Executive | Serve First Solutions, Inc.
 O (714) ***-**** x225 | TF (877) 737-7355 | F (714) ***-****
 *********@serve-first.com [mailto:**********@serve-first.com] | www.serve-first.com [http://www.serve-first.com/]
“Your Partner in Payment Processing”

Phishing Scam – 09/03/2020 – Assessment: September 3rd

This is a reply-to scam. The sender impersonates a K-State employee to receive a response from a legitimate K-state employee. The responsible e-mail addresses were reported to the appropriate channels.

From: “*********”
Date: Thursday, September 3, 2020 at 6:33 AM
To: ********* <*********@ksu.edu>
Subject: Assessment: September 3rd
Confirm if you are free? Need you to run a quick request. Get back to me as soon as you can.
Thanks
******

Phishing Scam – 09/03/2020 – Weekly Position Announcement FT/PT

This is a reply-to scam. The sender reaches out to 10 random K-State affiliated users for a fake job opportunity. The responsible e-mail addresses were reported to the appropriate channels.

From: ********* <*********@outlook.com>
Sent: Thursday, September 3, 2020 10:46 AM
To: ********* <*********@ksu.edu>; ********* <*********@ksu.edu>; ********* <*********@ksu.edu>; ********* <*********@ksu.edu>; ********* <*********@ksu.edu>; ********* <*********@ksu.edu>; ********* <*********@ksu.edu>; ********* <*********@ksu.edu>; ********* ; ********* <*********@ksu.edu>
Subject: Weekly Position Announcement FT/PT
You were referred with 10 other students from the Universities Educational Chamber Of Commerce to work and study for $400 weekly,Disability Resources and Educational Services looking for you to fill up this available position !If interested, Kindly send your phone Number and personal email address for better communication for more details also need.

Phishing Scam – 09/02/2020 – Follow Up

This is a reply-to scam. The sender impersonates a Dean of a department. The responsible e-mail addresses were reported to the appropriate channels.

From: ****** [mailto:*****.ksu.edu@gmail.com]
Sent: Friday, August 28, 2020 11:13 AM
To: ******
Subject: Urgent follow up
Hello *******,
How are you doing? Are you available for a quick task?

Best regards
*******.


Dean of Libraries Dean’s Office 3rd Floor/West End Alumni Center