The UW–Madison Office of Cybersecurity is aware of 2 active phishing campaigns on campus in which attackers impersonates UW–Madison employee support units. The campaigns’ email messages ask recipients to click a link to visit a fake COVID-19 benefits site, promising $2,300 in financial assistance. Two such campaigns have been reported as of this writing. One has the email subject line reading “support team” and the other “Green dot.”
Both campaign are very similar to that previously reported on June 7, 2021 but these target students as well as faculty and staff.
See the included text below.
From: [REDACTED]
Date: Tuesday, June 15, 2021 at 1:03 PM
Subject: support team
In response to the current hardship in the community due to the COVID-19 pandemic, University of Wisconsin has decided to support all Student & employees to get through these hard times.
The University of Wisconsin & Employee Support Program provides $2300 in assistance for qualifying employees who are experiencing financial hardship due to the coronavirus pandemic, starting from today, Tuesday, June 15, 2021.
Visit the WU COVID-19 Benefits [link removed for safety] page and follow all instructions carefully and enter the most appropriate details to successfully register.
Note: This Covid-19 Support program is Powered by Green dot and University of Wisconsin to help support amid the COVID-19 crisis, supporting our employee and the communities are essential during these challenging times.
Note: To help provide immediate grants to qualifying employees an ID verification is required, for your application will not be processed if your ID isn’t verified.
Sincerely,
COVID-19 support team
University of Wisconsin
Student & Employee support program
The most recent phishing emails that look like this example were sent in the afternoon of Monday, June 15, but such attacks can occur at any time. Please be on the lookout for such scams. You can recognize them in the following ways:
- Hover over links, without clicking them. Most email clients, including Outlook and O365 online will show the destination URL. In this case, the URL is clearly not associated with the University.
- Inspect URLs closely. Some scammers will try tricking you out by including relevant sounding keywords like the name of the company they’re impersonating – look at the whole URL to make sure it includes a legitimate domain name in the correct placement, e.g., “wisc.edu.”
- If in doubt, don’t click the link but browse directly to the legitimate, relevant website and look for confirmation of the email message.
What should I do if I accidentally clicked the link?
Immediately change your NetID password by following the instructions in NetID: Changing a Password (Source: KB 20589).
Reporting a phishing campaign
Outlook users:
To report phishing emails received via Outlook, please click the “Report Phish” button on the toolbar/ribbon located at the top of your page. This action will send the questionable email to the UW–Madison Cybersecurity Operations Center (CSOC).
Non-Outlook users:
If you do not see the “Report Phishing” button, then forward the message as an attachment (Source: KB 34567) to abuse@wisc.edu. Please do not simply forward the questionable email, as this will prevent us from seeing the header of the message and make it difficult to take appropriate action.
For additional information, please refer to: Office 365 – Submit a message as spam/phishing (Source: KB 45051).
If you are ever unsure whether an email message is legitimate, DO NOT RESPOND to it! Instead, contact the DoIT Help Desk (608) 264-HELP (4357) and ask for advice.