<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:black">Please alert staff in your department, lab or center about the phishing emails with subjects like “Incoming emails delayed…” “Missed Call” that look like they are coming from the MIT email server. The Security
Team in Information Systems and Technology (IS&T) has received several reports about it.<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<b><span style="color:black">How it works</span></b><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black">The email appears to be from MIT (with the display name of Massachusetts Institute of Technology) and many of these emails are coming from compromised MIT accounts. The message says you have some delayed email or are missing some messages
and includes a link to “Recover Delayed Messages.” This link will bring you to a fake Outlook.com login page. If MIT credentials are entered into this page, they will be copied by the attacker. The page then redirects to a legitimate email login page (either
O365 or OWA). If the user is already logged in, the email is displayed. If you are not logged in, you will see a login page and likely assume you mistyped your password.<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<a href="https://www.flickr.com/photos/ist_atmit/49493605087/in/album-72157674839514551/"><span style="color:black;text-decoration:none"><img border="0" width="740" height="438" style="width:7.7083in;height:4.5625in" id="Picture_x0020_1" src="cid:image001.jpg@01D5DCEA.25E43B30"></span></a><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<b><span style="color:black">Advising staff</span></b><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black">Please caution your staff not to fall for this kind of fake request. If they have clicked on the fake login page and submitted their Kerberos password, they should change their password immediately. The IS&T Service Desk can help recover
from a phishing attack.<o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="color:black">Encourage your staff to read up on </span><u><span style="color:#954F72"><a href="https://kb.mit.edu/confluence/display/istcontrib/Common+Email+Scams" target="_blank"><span style="color:#954F72">common email scams</span><span style="color:#954F72;text-decoration:none"> </span></a></span></u><span style="color:black">in
the Knowledge Base and to watch the quick<span class="apple-converted-space"> </span></span><span class="MsoHyperlink"><span style="color:#0563C1"><a href="https://youtu.be/ZkVr0GLSjE0"><span style="color:#954F72">“Beware of Phishy Emails!” video</span></a></span></span><span class="apple-converted-space"><span style="color:black"> </span></span><span style="color:black">for
tips on how to combat<span class="apple-converted-space"> </span>phishing. There are also Security Awareness courses available in the Atlas Learning Center.<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black">Please continue to report phishing emails like this to </span><u><span style="color:#954F72"><a href="mailto:phishing@mit.edu"><span style="color:#954F72">phishing@mit.edu</span></a></span></u><span style="color:black">. The best way
to send us the information that we need is to<span class="apple-converted-space"> </span></span><span class="MsoHyperlink"><span style="color:#0563C1"><a href="http://kb.mit.edu/confluence/x/dR6ACQ"><span style="color:#954F72">forward the email as an attachment.</span></a></span></span><span class="apple-converted-space"><span style="color:black"> </span></span><span style="color:black">If
your staff receives an email they aren’t sure about, or believe an account was compromised, they can always contact </span><u><span style="color:#954F72"><a href="mailto:security@mit.edu"><span style="color:#954F72">security@mit.edu</span></a></span></u><span style="color:black">.<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black">Thank you for your help in raising awareness about this scam.<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black">Sincerely,<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black">Jessica Murray<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black">Information Security Officer<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black">Information Systems and Technology<o:p></o:p></span></p>
<p class="MsoNormal" style="font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;caret-color: rgb(0, 0, 0);word-spacing:0px">
<span style="color:black">MIT<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
</body>
</html>