Stay alert to phishing attacks

The University of Oxford is a target for phishing emails which often aim to get hold of staff user names and passwords and once account details have been obtained, attackers have access to a whole host of personal and confidential data. Most of the time people don’t fall for phishing emails, but it only takes a handful of successful attacks to have a significant impact. Not only is University information potentially compromised, but accounts are also used to send out spam email and this could result in the University’s email services being blacklisted.

Below is an example of a credible attack that have been seen this past week.

The user receives an email alerting them that they have an important message, with a link to view the message.

If the user clicks on the link to view the “important message”, they are taken to a spoofed Oxford University WebAuth page where they are asked to enter their credentials. Once the credentials have been entered, the attacker gains access to their SSO account.

This is one of the many well-crafted and realistic phishing campaigns you might encounter. Please remain vigilant and report phishing attempts targeting University credentials to phishing@infosec.ox.ac.uk. Include the original phishing email as an attachment, with confirmation of whether you have divulged your credentials or downloaded any attachments.

For more information on email scams visit the InfoSec website.