1. Home
  2. About
  3. utech news
  4. Information Security Office Shares Guidance on Recent Simulated Phishing Email

Information Security Office Shares Guidance on Recent Simulated Phishing Email

Article Date
November 28, 2023

Did the [U]Tech's Information Security Office hook you with its most recent simulated phishing email? It was sent to full-time faculty and staff from "mgmt" on Nov. 15, and had the subject "Employee Salary NOV’23."

Screenshot from an email inbox, displaying a single message from sender “mgmtâ€, with subject line “Employee Salary NOV’23†and a visible snippet reading “ÐÇ¿Õ´«Ã½ D…†and a time of delivery 10:10: AM

If you look closely at the message, you can see several indicators that this message is not legitimate.

Here’s what the email looked like – notice the yellow "External" tag, which should alert you to be careful, along with the non-ÐÇ¿Õ´«Ã½ sender address of "mgmt@my.webshar.es":

Screenshot of the phishing email. Subject: Employee Salary NOV’23. The word “External†is highlighted in yellow, indicating that Google has added a tag to the email to mark it as sent from outside the case.edu domain. The message header information reads “mgmt <mgmt@my.webshar.es> to me. ÐÇ¿Õ´«Ã½ Dear Employee, As already announced, The year’s Wage increase will start in November of 2023 and will be paid out for the first time in December, with recalculation as of November. View [link:salary_increase_sheet_November-2023.xls] You will be informed of the details in advance by letter from the personnel department. Regards ÐÇ¿Õ´«Ã½ Management

The subject line—"Employee Salary NOV’23"—should trigger suspicion: salary increases are typically processed in the summer. The body of the email mentioned the "upcoming" wage increases for personnel. This is an example of how phishing attacks prey on the recipients’ sense of responsibility, and create false urgency by implying you will lose access to something important if you do not act.

If you clicked the link in the email and then submitted your ÐÇ¿Õ´«Ã½ login credentials on the generic login page (which lacked any ÐÇ¿Õ´«Ã½ branding and didn’t use the university’s Single-Sign On interface), it took you to an educational awareness page with valuable tips on what to do if you receive a real phishing email. It also contained information about types of phishing emails, and what to watch out for in the future.

Two screenshots, side-by-side, that capture the visual presentation of the login page and password prompt. On the first screenshot, there is a colorful, Google-esque circle logo, and below it the text reads “Sign in with your one accountâ€. There is a text-entry box labeled “Email†followed by a link reading “Forgot email?†The next line reads “Not your computer? Use Guest mode to sign in privately. [Link: Learn More] [Link: Create account] [Button: Next] The second screen shot has the same colorful circle logo, and reads “Sign inâ€. The email address entered at the last screen, in this case “notreal@here.comâ€, is presented on the next line, followed by a text-entry box labeled “Enter your password.†There is a checkbox option to “Show passwordâ€. [Link: “Forgot my passwordâ€] [Button: Sign In]

If you were hooked and provided your real ÐÇ¿Õ´«Ã½ credentials, not to worry. In this instance, your information was not stored or harvested by attackers. If you realize you’ve been hooked by a real phish, you should change your ÐÇ¿Õ´«Ã½ passphrase as soon as possible, to something radically different.

You can reset or change your passphrase from the Single-Sign On page using the link there to reset or change your passphrase.

This is a screenshot of the ÐÇ¿Õ´«Ã½ Single Sign-On screen, with a circle and an arrow over the right-hand column of links to the pages for our self-service operations such as resetting your passphrase or contacting the Service Desk. The screen has two columns. The left-hand side reads: [Logo: ÐÇ¿Õ´«Ã½] [Text: Single Sign-On] ÐÇ¿Õ´«Ã½ ID: example – abc123 [Text input box for username] Passphrase: [Text input box for passphrase] [Link: Forgot your passphrase?] The right-hand column reads: QUICK LINKS [Link: Activate ÐÇ¿Õ´«Ã½ Network ID] [Link: Reset your passphrase] [Link: Change your passphrase] [Link: Service Desk] [Link:UTech Home Page] [Button: Login]

For more security awareness information, and to view our gallery of phishing examples, visit .