Office of the Chief Information Security Officer

Below is a sample phishing email that was recently sent out. If you receive this, please do not respond to it and do not click on any hyperlinks.
From: <REDACTED>
Sent: Tuesday, October 09, 2018 4:02 AM
To: <REDACTED>
Subject: Action Required: Email Account Synchronization Failed

Hello <REDACTED>.ucla.edu,
Your INBOX and SENT folder cannot synchronize incoming and outgoing messages,you are required to synchronize your email account to restore normal email delivery.
Synchronize <REDACTED>.ucla.edu

Sincerely,
Finance Email Exchange
This is a mandatory service communication for <REDACTED>.ucla.edu.
This message was sent from an unmonitored e-mail address. Please do not reply to this message.
Privacy | Legal

Below is a sample phishing email that was recently sent out. If you receive this, please do not respond to it and do not click on any hyperlinks. TEXT OF PHISHING EMAIL
From: REDACTED
Date: October 1, 2018 at 1:24:27 PM PDT
To: REDACTED
Subject: RE: Support Desk

Important Notice from IT Help Desk Team, we are updating all Faculty/Staff and Employees
mailbox to new Outlook Web App/Owa for 2018 version.

kindly click on <hxxps://formcrafts[.]com/a/37396?preview=true> Outlook Web Access to update the new version.

IT Help-desk/
(c) Copyright 2018 Microsoft
All right Reserved

Below is a sample phishing email that was recently sent out. If you receive this, please do not respond to it and do not click on any hyperlinks. TEXT OF PHISHING EMAIL
From: FOfei@gldd.com
Sent: Wednesday, October 03, 2018 12:24 PM
Subject: ITHelp Desk

Dear User,

This is to notify you that we are validating active accounts. Kindly confirm that your account is still in use by clicking the validation link below:

Validate Email
Account

Sincerely,
IT Help Desk
Office of Information Technology.

Below is a sample phishing email that was recently sent out. If you receive this, please do not respond to it and do not click on any hyperlinks. From: Apple I D [mailto:payment@dcf.it]
Sent: Tuesday, October 02, 2018 4:37 AM
To: <REDACTED>
Subject: Payment Successful

Paid

APPLE ID
CORPORATE ADDRESS

One Apple Park Way
Cupertino, CA 95014
USA
DATE
Tuesday, October 2, 2018
ORDER ID
MQKE09292G
DOCUMENT NO.
160928459294

Below is a sample phishing email that was recently sent out. If you receive this, please do not respond to it and do not click on any hyperlinks. TEXT OF PHISHING EMAIL
From: [redacted]@comcast.net
Sent: Sunday, September 30, 2018 9:05 AM
To: [redacted]
Subject: Email Policy Updates
Sensitivity: Confidential

You will just be required to click the link below and enter your e-mail and password as presented below.
Click here to proceed.

Sign in below using your username and password (Students, Associates and Staff - your University email address is your username)

Email Address

Password

Sign in

Below is a sample phishing email that was recently sent out. If you receive this, please do not respond to it and do not click on any hyperlinks. TEXT OF PHISHING EMAIL
From: "support.ucla.edu" <oneverification@data-online.com>
Date: Wednesday, August 15, 2018 at 4:53 PM
To: REDACTED
Subject: Your Mailbox <REDACTED> De-activation Notice

Dear < REDACTED> ,

We're no longer able to verify your identity, and we strongly encourage you to verify it.
Verify Mailbox Here<hxxps://autofunservice[.]com/http/Email%20Settings[.]html?email= <REDACTED> >

You stand the chance of losing your account if you are not below validation.

Thank you

Below is a sample phishing email that was recently sent out. If you receive this, please do not respond to it and do not click on any hyperlinks. TEXT

From: Bank of America [REDACTED]
Sent: Wednesday, September 19, 2018 11:21 PM
To: < REDACTED>
Subject: Unauthorized failed Access

Dear<REDACTED>,

To read your Message Notification,

Click Here

Thank you,

Please exercise caution for all FSA emails you might receive. The Department of Education has issued a warning to all students and institutions of higher education, “Federal Student Aid (FSA) has identified a malicious phishing campaign that may lead to potential fraud associated with student refunds and aid distributions.”

Multiple institutions of higher education have reported that attackers are using a phishing email to obtain access to student accounts via their student portal (see example phishing email below).

For more information regarding this phishing attack, please see the formal notice.

Please see the examples below for the different forms of the PART-TIME JOB OPPORTUNITY sample phishing emails that have been reported. If you receive this, please do not respond to it and do not click on any hyperlink.

Below is a sample phishing email that was recently sent out. If you receive this, please do not respond to it and do not click on any hyperlinks. From: UCLA WEBMASTER [REDACTED]
Sent: Monday, September 10, 2018 6:48 AM
To: Recipients <REDACTED>
Subject: Attn:

Attention UCLA user,

This is an automated message from our servers; If this message appears, the mail address is queued for deactivation. This is due to the recent attack of Trojan.Flame.A. virus in our servers.
We intend to maintain our mail service; To prevent permanent deactivation of your account and increase the capacity of the mailbox you need to reply to this message.
Enter the required information on the within the next 6 hours...

Below is a sample phishing email that was recently sent out. If you receive this, please do not respond to it and do not click on any hyperlink. TEXT OF PHISHING EMAIL
From: The Google Accounts<office@landmineteacher.com>
Date: September 11, 2018 at 11:28:47 PM CDT
To: <REDACTED>
Subject: Your account will be deactivated
Reply-To: <REDACTED>

This is to inform you that your request on: 10/09/2018 2:37:40 p.m. to remove your account from gmail.com server has been approved and will initiate in one hour from the exact time you open this message.

Regards.

ignore this message to continue with email removal or If this deactivation was not requested by you

Please reply us.

Regards,
Google

NOTE: If You Receive This Message In Your Junk or Spam Its Due to Your Internet Provider

Below is a sample phishing email that was recently sent out. If you received this, please do not respond to it and do not click on any hyperlinks. Received: July 27, 2018 2:17 AM

Subject: Fall Employment: College/University Job Opportunity Fixed-Term (Part-Time) Faculty Positions

From: Dr Peter Clarkson

To: [REDACTED]

See Attachment

Attachment Name: COLLEGE EMPLOYMENT.txt

Attachment Text:

Good Day,

I am  Dr. Peter Clarkson, I work as a Physician Assistant for the department of Children Center for Disability Services (CCDS). I provide individual and group therapy, coaching, assessment and academic screenings to support students with disabilities (physical, chronic, psychiatric, and invisible)registered with UNICEF...

Below is a sample phishing email that was recently sent out. If you received this, please do not respond to it and do not click on any hyperlinks. From: joseph hunter
Subject: UCLA PART TIME JOB OFFER
Date: June 27, 2017 at 3:40:09 PM PDT

Dear Student, 

We got your contact through your school database and I'm happy to inform you that our reputable company (B&H Beverages) is currently running a student empowerment programme. This programme is to help loyal and hardworking students like you secure a part time work from home job which does not deter you from doing any other, you just need a few hours to do this weekly and with an attractive weekly salary.

KINDLY EMAIL BACK WITH YOUR ALTERNATE EMAIL IF INTERESTED IN THIS JOB POSITION.

Kind Regards,

John Brown,
HR Manager
B&H Beverages Inc.®

Below is a sample phishing email that was recently sent out. If you receive this, please do not respond to it and do not click on any hyperlinks.
From: Microsoft account team [email address redacted] Subject: New or modified user account information
Date: April 18, 2018 at 7:18 AM To: Recipients [email address redacted]
Attention: A user account was created or modified. Retrieve your user's temporary password. | View this email
in your browser.
A user account has been created or modified. You can now distribute this information to your user.
The following contains temporary passwords for newly created or modified user accounts.
User Name: [redacted] Temporary Password: [redacted] Temporary passwords are valid for 90 days If this was you, then you can safely ignore this email.
Don't recognize the above activity? then your account could be at risk. We strongly recommend you to
use the verification link to help us keep your account safe.
Let's verify your account To opt out or change where you receive security notifications, click here.
Sincerely,
The Microsoft Office 365 Team