Phishing Alert: EMAIL ACCOUNT UPGRADE

Sun, 26 Sep 2021 21:20:48 -0400
notice

The Division of Information Technology( DoIT) recently received reports about an “account upgrade” phishing email. Below is an example of such an email. We removed the recipient’s information for privacy reasons.

From: support <noreply@umbc.edu>

Date: Sat, Aug 28, 2021 at 5:49 PM

Subject: EMAIL ACCOUNT UPGRADE

To: <UMBC ID@umbc.edu>

This email was spoofed to impersonate <noreply@umbc.edu>; however, after investigating the headers, we realised it originated from <raaympex@yandex.com>. By clicking the upgrade button, it will redirect you to a website that looks similar to umbc.edu. Afterwards, you will receive a pop-up saying, “your session expired.” See below.

The background is umbc.edu, but the pop-up is from a completely different website, <https://firebasestorage.googleapis.com>. The link in the email is similar to the one listed below. The only difference is that your campus ID will change depending on the recipients.

https://firebasestorage.googleapis.com/v0/b/updates-efda3.appspot.com/o/domain%2Findex.html?alt=media&token=0e92d80b-425e-4147-91e7-8d67820f6e7b#<CampusID>@umbc.edu

If you have received this email, please DO NOT CLICK on the link. However, if you have clicked on the link, DO NOT ENTER your password. If you entered your UMBC password, immediately change your password.

If you have received any message similar to the one listed above, please forward it with its headers to security@umbc.edu. For instructions, visit: https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970.

______________________________________________________________________________________________________________________________________