To access this content, log in with your DuckID. The page will now redirect to the login page. If it doesn't automatically redirect you, please click here to login.

Document shared with you: ‘Employee_Misconduct_Report_Alleged_Sexual_Harassment.docx’

 
 
Submitted by iso-epperson on
Comments

This email uses an eye-catching file name to make the user more intrigued to open the file and follow the instructions. Several details identify it as a phish: the line "Human Resource Team," which is meant to make the message appear to come from someone higher up and important; the use of a Gmail account, since the university would never contact you from a Gmail address; and the poorly designed Google Docs form that appears after opening the shared .docx file and clicking the link inside it.

Alert Type
Phishing Email (in the wild)
Date Entered
From
curtinroofs@gmail.com
Date Sent
Message Content

Human Resource Team shared a document

Human Resource Team (curtinroofs@gmail.com) added you as an editor. Verify your email address to make edits securely to this document. You will need to verify your email address every 7 days. Learn more

Ryan Tucker Jones shared a file with you.

Employee_Misconduct_Report_Alleged_Sexual_Harassment.docx

 

This email grants access to this item without logging in. Only forward it to people you trust.

Image
After clicking the uoregon link, we find a fake google forms page, asking for the user to input their uoregon credentials.
Here is what we see after opening the docx file shared by the bad actor. Clicking the fake uoregon link, brings us to the page seen in the next image.