Phishing Email Scam: Update Credentials

Phishing Email Breakdown 

This recent phishing attempt impersonates McMaster University by notifying users that their password needs to be updated today. Users who click on the link are brought to a fake Microsoft page which asks them to sign in. Once signed in, threat actors will have access to the user’s account and password. 

Visual Example of the Phishing Email 

Full Text from the Phishing Attempt 

Office-365 

Hello USER, 

Your credentials is due for update today. 

You can change or keep your credentials . 

Keep Credentials 

mcmaster.ca Mandatory Service 

How to Protect Yourself? 

1. Verify the Sender: Always verify the identity of individuals claiming to be someone important, especially if the message seems out of the ordinary and asks for personal information. 
2. Review Grammar and Punctuation Carefully: If a message is filled with spelling mistakes, inconsistent sentence structure, or odd phrasing, it may indicate a phishing attempt. 
3. Watch Out for Emotional Triggers: Phishing emails often use fear, sympathy, or urgency (e.g., “Your account will be closed immediately!”) to push users into acting without thinking. Pause, reevaluate the request, and confirm its legitimacy before responding. 
4. Be Mindful of Generic Greetings: Phishing emails commonly start messages with “Dear User” or “Dear Sir/Madam” rather than using your real name. Legitimate messages typically include your actual name or specific account details. 
5. Check Branding, Formatting, and Logos Carefully: Phishing emails may imitate official layouts or use low-quality, off-colour logos. Verify that logos, colours, and the overall format matches what you typically see from the genuine organization. 

Important Notes: 

1. Report Suspicious Messages: Reporting phishing attempts helps prevent others from falling victim to these attacks. Send suspicious messages to is-spam@mcmaster.ca for review and investigation. 
2. Educate Yourself: Learn about common phishing tactics. Consider participating in the Information Security Training Program to protect against cyber threats and secure your digital world.