Recent Phishing Email

Lately, we have noticed some slightly more unusual phishing emails that have come in. These emails have been designed to look like they were sent from Microsoft and claim to have an audio attachment. However, the attachment is a .htm file that likely contains something malicious.

A screenshot of one of these emails:

A quick recap of what to look out for when trying to identify if an email is phishing or not:

•        A sense of:
o        Urgency – makes you feel like you have to do something quickly, so you don’t take the time to wonder if the email is suspicious.
o        Fear – for example, if you don’t click on the link, your account will be deleted, or you will be fined.
o        Promise of reward – lottery win notifications, or “I am the widow of a rich person” type of email.
o        Guilt or sympathy – “I am dying of…” type of email.

•        ‘To’ and ‘From’ address – these can be trivially forged and show false information. Often the ‘To’ address isn’t even your email address; a legitimate email would be addressed to your actual email address.
•        Web link – check to see if the link is in the UCL domain (ucl.ac.uk), it could look like a legitimate UCL URL but check by hovering over it as it could be going somewhere else entirely. If you are unsure about the URL, check with the sender.
•        Asking you to respond with your username and/or password – no legitimate email will ask you to do this.
•        Unexpected attachment – some phishing emails come with attachments that when opened will compromise your computer.
•        Headers and signatures – these can be forged; phishing emails often use them to appear more legitimate.

As always, if you need any help or support with a security related issue, please contact us: isg@ucl.ac.uk.