You’ve got a new voicemail (phishing) email!

As remote work and online classes are increasingly becoming a gateway for advanced cybercrimes, it is important that members of the University of Toronto (U of T) community stay aware of how to spot and report phishing attacks.

This week, members of the U of T community including employees, faculty and students received a voicemail-to-email phishing attack, which was successfully thwarted. The email contained an attachment with a malicious link and was marked as ‘External’ to mislead the recipient into thinking it was sent by a trusted external source.

The image below marks the red flags to look out for:

Phishing email about voicemail containing malicious attachment

Image: The email asks the recipient to click on the attachment to listen to the voicemail, which is a malicious link to a .HTM file.

If you receive an email like this or other suspicious emails, please do not click on any links or download any files from the email. Make sure to report suspicious emails to and brush up on the common red flags so, you know what to look for.

To learn more about the recent phishing attacks and how to keep yourself safe online, visit:

[Phish] 50141497*** Received -TSID: Powells WellCare Received on January 3, 2022, 3:22:33 PM


Subject: 50141497*** Received -TSID: Powells WellCare Received on January 3, 2022, 3:22:33 PM


New Voicemail Received.

Date received Monday, January 03, 2022
Caller Number *Malicious number inserted here*
Duration 00:00:54
Reference 1783-829-66312TD


To listen to this voicemail, click on the attachment in this email.*Malicious link attached as voicemail*

[Phish] You have got an urgent message from the University of Toronto.


Subject: You have got an urgent message from the University of Toronto.


Dear User,

This is to let you know that our web-mail server will be upgraded and maintained soon.

If you don’t want your e-mail account to be terminated during the upgrade,

Send “UTORONTO–UPGRADE” to *malicious phone number inserted here*

You will receive instructions on how to upgrade your account via text message.

If you do not comply with the above, your email access will be disabled.

Please accept our apologies for any inconvenience this may cause.


System Administrator

The University of Toronto

[Phish] Open position:customer support representative,apply now.


Subject: Open position:customer support representative, apply now.


A customer support representative position is available, with a decent weekly salary and the ability to work remotely.

*The job will only require 1-2 hours of your time every day, Monday through Friday or on weekends.

The ideal candidate will be dependable, timely, and trustworthy.

POSITION: customer support representative

*Ability to work independently
*Basic computer knowledge

*To apply, text “Job application” to: *fake phone number inserted here* 

[Phish] [IMPORTANT]: University of Toronto recruiting department.


Subject: [IMPORTANT]: University of Toronto recruiting department.


Hello Selected candidate,

We received your resume application via the University recruiting department, offering a part time position for Freshman, Sophomore, Junior, Senior, Graduating Students, Staff or retired, this will only require 1-2hrs 3 days a week, no work experience or skill is required. You can make $700 bi-weekly ( every two weeks )without affecting your regular activities and academics

To Apply, kindly follow the link or email/text below

*Malicious link inserted here*

*Fake name inserted here*
Tel: *fake phone number inserted here*
*Fake email address hyperlinked with malicious link inserted here*

Surge of phishing attacks at the University of Toronto

Social engineering is designed to evade common security setups by targeting the people inside organizations — relying on human error as the weak link. While hackers’ approaches behind social engineering may differ in form, their goals are all very similar: identity theft, data breaches, ransomware attacks and more.

Phishing, one of the most popular forms of social engineering, is becoming more common with each day. It is very important to educate ourselves about cyber security to ensure our individual and institutional data remains protected. Equipping ourselves and the University of Toronto (U of T) with sophisticated and advanced tools is only half the battle. We can be proactive in preventing data breaches and other attacks by staying educated and aware, and therefore avoiding potential for human error.

Recently, there has been an influx of phishing emails containing malicious links targeted at U of T community members. These attacks have been impersonating U of T administrator roles and targeting unsuspecting community members.

Below are two recent emails that were sent to U of T community members. Review the red flags to help you understand the anatomy of a phishing email:

Phishing email spoofing UTORid website

Image 1: This recent phishing email contains a malicious link to a spoofed UTORid web page. The email was sent from an email address impersonating a U of T staff member.

Phishing email pretending to be U of T IT department

Image 2: This email prompts U of T community members to click on a link to ‘update their account’. 

At first glance, phishing emails often look like legitimate communications from a trusted organization. No matter how real it looks, treat every email you receive with caution — especially ones you weren’t expecting to receive. In the case of receiving a suspicious email, review the common red flags to identify if action is required to report and remove the email.

If you receive a suspicious email, ensure you report and delete the email immediately.

For information on how to report a phish, visit

Visit the Phish Bowl and the Security Matters blog to read about recent phishing attacks within the U of T community.

[Phish] Covid-19 Support


Subject: Covid-19 Support


In response to the current hardship in the community due to the COVID-19 pandemic, The University of Toronto has decided to support both Faculty & Staff and Students to get through these hard times.

The University of Toronto will award CAD 2,920 COVID-19 support to all eligible Faculties, Staffs and Students, starting from today, Monday, 1 November 2021.

Visit the University of Toronto giveaway page and register with your information to be eligible for this giveaway.

Note: If you do not submit all the information requested, your application will not be processed.


COVID-19 Support Team

University of Toronto
27 King’s College Cir, Toronto, ON M5S 1A1, Canada

Beware of ‘COVID-19 Support Team’ phishing email

The battle against phishing attacks is an ongoing, daily task. Though we are equipped with highly-sophisticated and advanced tools for protection, hackers retaliate by evolving their techniques to evade these protections.

It is important to continually educate ourselves and maintain awareness about phishing attacks to ensure our individual and institutional data remains protected. Hackers use techniques such as spear phishing to persuade email recipients to click a link which can then distribute malware onto their devices or grant hackers access to their data. Some phishing attacks are used as means to steal credentials, which can cause further damage to both the recipient and the University of Toronto (U of T) on a higher level.

Since the beginning of the COVID-19 pandemic, Statistics Canada has determined that just over four in ten Canadians have received a phishing attack. Hackers have been taking advantage of people’s vulnerable state in these unprecedented times by sending fraudulent emails that attempt to trick recipients into revealing personal information or clicking on malicious links or attachments.

On Nov. 1, 40,000 U of T community members received an email from the University’s ‘COVID-19 Support Team’ (which does not actually exist). This email encouraged recipients to fill out a form on the ‘University of Toronto giveaway page’ to become eligible for a one-time cash reward.

If you received this email, please ensure to report and delete the email immediately.

Take a look at some of the red flags to help you identify a phishing email:

How to spot phishing email

  • No greeting: Phishing emails are usually sent in mass, and therefore rarely include a personalized greeting. Instead, it’s common to see a vague greeting such as “Dear Member”, “Hello” or no greeting at all.
  • Poorly written email: One of the more common signs of a phishing email is spelling mistakes and poor grammar. Another sign is formatting inconsistencies throughout the email. Notice how the font size, type and colour changes in this example.
  • Suspicious link: Phishing emails almost always contain a link that either takes users to a cloned website or downloads malicious software. These links are often crafted to appear genuine by using a URL that looks like a legitimate one. One of the ways to verify a URL’s legitimacy without clicking on it is by hovering your cursor over the link and verifying the address revealed in the popup box. In this email, hovering over the link revealed a link that is not associated with U of T.
  • Threat and a sense of urgency: Emails that threaten negative consequences should always be treated with caution. This is a tactic used by hackers to encourage or even demand immediate action, which flusters the recipient into acting without being given time to think about it. Note how the hacker threatened the recipient into providing their personal information in order for their application to be processed.

What to do if you receive this phishing email:

  • Do not act on any of the email prompts including clicking the link, providing personal information or opening the attachment.
  • Forward it to and then delete it from your inbox.
  • If you already clicked on the link or attachment, please contact immediately for assistance.
  • To help prevent future phishing attempts, we encourage community members to enrol in U of T’s multi-factor authentication (MFA) service, UTORMFA:

For more information about protecting yourself online, please visit: