phishing

Four tips for safe online shopping

December 4, 2023

Holiday shopping season is around the corner! With great discounts and offers, also comes the risk of online fraud and scams.

Here are four simple yet effective tips to have a safe online shopping experience:

  1. Before making any online payments, ensure a secure connection by verifying that the website’s URL begins with “https://” and has a padlock symbol in the address bar.
  2. Don’t click on links in unsolicited emails or pop-up ads; instead, directly access the retailer’s website by typing the URL into your browser.
  3. Enhance transaction security by using a secure personal network instead of public Wi-Fi, as public networks are less secure.
  4. Use a password manager to store the passwords for all your accounts, because passwords are the first line of defence against online threats.

Download the tipsheet in PDF format.

Visit the Security Matters website regularly to learn more about online safety tips and resources.

[Phish] University of Toronto – termination of your UToronto Email

November 3, 2023

Image of spoofed web page

Spoofed UTORid web page

Some U of T community members reported receiving this phishing email. Do not respond, click any links or provide personal information if you receive this email.

Description of the phish

This phishing email attempts to steal the user’s login credentials by providing false information about their UTORid being filed for deactivation. The email contains a link to a web page spoofed to look like a U of T web page. The URL mentioned in the email was also replicated to look like a UTORid related web page.

Such emails can cause panic to the recipients, prompting them to act on the instructions without thinking. Always pause to think and look out for red flags when you receive a suspicious email.

How to protect yourself

  1. If you receive requests for services such as UTORid or password reset that you did not initiate, do not engage.
  2. Report suspicious emails to report.phishing@utoronto.ca.

What to do if you engaged

If you engaged with the sender, please reach out to security.response@utoronto.ca immediately.

Email details

Subject: University of Toronto – termination of your UToronto Email

Dear UToronto Email User,

According to our records, you recently requested the cancellation of your UToronto Email account.

If you were unaware of this request, it is recommended that you verify your account.

To verify your account click link below: If you do not verify your account, your account will be terminated.

*malicious link*

Warm Regards,

*Incorrect email signature*

[Phish] Qishing message on LinkedIn

October 13, 2023

Description of the phish

This is qishing, a social engineering tactic where malicious actors use QR codes to steal information from unsuspecting recipients. This message was sent to U of T community members via LinkedIn.

How to protect yourself

If you receive an unsolicited QR code, do not scan the code as it could be a phishing attempt.

Email details

This link works for anyone in your organization.

Atatched is a brief presentation, please take a look and let me know if we could take on a joint development on this projects or any other means.

Scan the below QR code using your phone to get started.

*Malicious QR code*

Microsoft respects your privacy. To learn more, please read out Privacy Statement.

Microsoft Corporate, one Microsoft Way, Redmond, WA 98052

[Phish] UofT: Duo Security Appointment Form

October 2, 2023
Some U of T community members reported receiving this phishing email. Do not respond, click any links or provide personal information. If you receive a Duo Mobile push notification for UTORMFA or other MFA-enabled accounts that you did not initiate, do not approve the request.

Description of the phish

This phishing email attempts to steal personal information, login credentials and Duo one-time passcodes by providing false information about the user’s UTORid/JOINid being filed for deactivation.

How to protect yourself

  1. If you receive a Duo, UTORMFA or any other MFA notification that you did not initiate, do not approve the request.
  2. Do not respond to emails that ask for your MFA one-time passcodes and report them to report.phishing@utoronto.ca.

What to do if you engaged

If you engaged with the sender, please reach out to security.response@utoronto.ca immediately.

Email details

Subject: UofT: Duo Security Appointment Form

Your UTORid / JOINid account has been filed under the list of accounts set for deactivation due to retirement/graduation/or transfer of the concerned account holder.

But the record shows you are still active in service and so advised to verify this request otherwise give us reason to deactivate your university account.

Please send the requested information below to this phone number *malicious phone number* via SMS ONLY, to verify your UTORid / JOINid immediately to avoid Deactivation and to book an appointment:

* Full Name:

* Campus Email:

* UTORid / JOINid:

* Passw0rd:

* DUO Security Cell Phone Number:

* Duo 6 digit passcode on your Duo Mobile (Kindly check your Duo Mobile) :

* Date of Birth:

NOTE: Please check your Duo Mobile and fill in the 6-digit passcode above correctly.

Please note the one-time submission and entry only..

[Phish] (Attn user.name) | 2 Factor Authentication (2FA) Outdated Today | Friday-September-2023 06:53 AM

September 18, 2023

Details:

Subject: (Attn user.name) | 2 Factor Authentication (2FA) Outdated Today | Friday-September-2023 06:53 AM

Microsoft 2FA Policy

Dear user ,

Your authenticator session is expiring today, Kindly re-authenticate to avoid being locked out of your email account.

Quickly Scan below QR Code with your Smartphone camera to re-authenticate your password security.

*malicious QR code*

CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information or may otherwise be protected by law. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message and any attachment thereto

If you receive a Duo Mobile push notification for UTORMFA or other MFA-enabled accounts that you did not initiate, do not approve the request.

Navigating the world of ChatGPT: Cyber security risks and awareness

September 18, 2023

The Ontario Cyber Security Centre of Excellence recently published an article about the artificial intelligence (AI) chatbot ChatGPT, capable of human-like conversations and performing tasks such as generating content ideas and simplifying complex topics.

However, there are significant cyber security risks associated with ChatGPT. These include the potential for malicious code generation, crafting convincing phishing emails, privacy concerns and more.

Users are advised to exercise caution and be cyber aware when interacting with ChatGPT, as it may provide inaccurate information. To stay safe online, remember to report suspicious emails, avoid sharing sensitive data and stay updated on social engineering tactics.

In an era where AI like ChatGPT is becoming increasingly integrated into our daily lives, it is crucial to balance its benefits with a proactive approach to cyber security.

To read the article, visit the Cyber Security Centre of Excellence website.

 

Strengthening security awareness: Inviting appointed staff to lead the way

August 14, 2023

In June 2023, the University launched the Security Awareness Training (SAT) Foundations project as part of the broader Security Awareness and Training Program (SATP).

Co-led by Raphaelle Gauriau, Manager, Information Security Strategic Execution, ITS and John Stewart, Information Security Program Manager, I&ITS, U of T Scarborough, the project aims to provide U of T staff, librarians and faculty with baseline training to help improve their knowledge about essential information security topics and threats.

“In an ever-evolving digital landscape, equipping ourselves with the right tools and knowledge is important to keeping our people, data and systems secure and safe. We are hoping the U of T community will join us in this journey to collectively strengthen our digital resilience,” said Raphaelle.

Following the successful launch of phase one, the team is now inviting all tri-campus units to participate in phase two of the project. During this phase, appointed staff from participating units may be onboarded to the project.

Phase two will run from September 2023 to March 2024.

By engaging in phase two, units will have access to comprehensive training modules, thoughtfully designed to be both engaging and informative. These modules cover a wide range of topics, from identifying phishing attempts to safeguarding sensitive data.

The first 20 units to join the program and the first 50 participants to complete the training will have an opportunity to win exciting prizes.

“We are excited to extend the SAT Foundations project to all tri-campus units. Information security is a collective responsibility and by empowering individuals with baseline training, we can collectively build a more secure digital future,” expressed John.

How can units join the project?

Interested units can reach out to Ben Akhirevbulu, Project Manager.

For more information, visit the SAT Foundations web page.

[Phish] CAMPUS RECRUITMENT AT THE UNIVERSITY OF TORONTO

July 27, 2023

Details:

Subject: CAMPUS RECRUITMENT AT THE UNIVERSITY OF TORONTO

Hello Selected candidate,

We received your resume application via the University recruiting department, offering a part time position for all students and staff, this will only require 1-2hrs 3 days a week, no work experience or skill is required. You can make $650 weekly without affecting your regular activities and academics

 

To Apply, kindly follow the link or email/text below

 

*Malicious link*

Administrator

*Malicious website link*

UofT Employee Self-Service

 

If you have received a suspicious email:

  • Please report it to report.phishing@utoronto.ca.
  • Delete the email immediately from your mailbox.
  • Don’t click any links, download attachments or engage with the sender.
  • Please do not forward or share the email with your colleagues and other contacts.

Learn more about what to do if you suspect a phishing attempt.

[Phish] UTSU Cyber Security: Duo Security Form Urgently Needed

July 5, 2023

Details:

Subject: UTSU Cyber Security: Duo Security Form Urgently Needed

Kindly fill and submit the student course registration form to book an appointment for the on-going Duo Security Update interview below, Once done and submitted, then i can have your appointment approved and booked. It’s imperative as a student at the University to book an appointment today for this exercise and fight against Phishing. This exercise is meant for the school database, course upgrade, Duo Security Update/Confirmation and Fight against Phishing. Failure to comply will result in blocking your UofT campus email address with immediate effect.

Register here *malicious link*

You will be contacted via SMS within the next 14 days or more, just to confirm you already enrolled for Duo Security and to make sure its enabled, so we will contact you via SMS( with your JoinID so you can know and confirm it’s from the school security dept) when logging into your Utoronto Mailbox Account to either push the Duo Security Button on your phone or send us the code that will be sent to your cell phone number registered with the Duo Security, in order to access your account and confirm everything is intact, is that understood?. This exercise will be done repeatedly.

This form enables us to perform the monthly database, course upgrade and security check. Please fill and submit the form with the correct information and we will be in touch.

NB: A push request/code will be sent to your device to confirm your login credentials, you will accept the push request on your device/send me the code once we contact you via text message.

If you receive a Duo Mobile push notification for UTORMFA or other MFA-enabled accounts that you did not initiate, do not approve the request.

Beware of MFA fatigue

April 25, 2023

Scammers use social engineering tactics to gain access to organizational systems and cause data breaches. One tactic that has increased recently is MFA fatigue, which overwhelms users with continuous MFA notifications (such as the UTORMFA Duo Mobile prompts) until they approve the login request to stop the surge of notifications being sent to their devices.

How to protect yourself from MFA fatigue

  1. If you receive a Duo Mobile push notification for UTORMFA or other MFA-enabled accounts that you did not initiate, do not approve the request.
  2. Immediately change your UTORid password and contact the IT Helpdesk for additional recommendations.

Additional resources for digital safety