Skip to main content

Recent Examples of Phishing

These are some examples of phishing emails seen on campus. Do NOT assume a suspect email is safe, just because it is not listed here. There are many variants of each, and new ones are being sent out each day.

Access locked: Server Error

Phishing emails using a compromised SUNet id. Hovering on the link reveals the malicious URL.

From: Stanford University <compromised@stanford.edu>
Sent: Wednesday, November 20, 2019 8:44 AM
To: user <user@stanford.edu>
Subject: Access locked: Server Error

Due to a server error on your e-mail, (user@stanford.edu) (7) incoming messages were delayed.

Log on to your portal to recover your delayed messages
Recover Delayed Messages
2019 Message Center

from <random phone number>

Attachment that mimics a sound file but it is really a HTML page. Leads to a credential harvesting page.

From: Scott Spain <sspain@oreganos.com>
Sent: Thursday, November 14, 2019 2:42 AM
To: user@stanford.edu
Subject: from (671) 322-3152

Duration - {00:59} secs.
Time - 14-Nov-2019 05:42:15

Urgent Scheduled Meeting

Hovering over the link reveals the true nature of the email. Broken english is another red flag.

From: Stanford University <infoportal@stanford.edu>
Sent: Monday, November 11, 2019 10:01 PM
Subject: Urgent Scheduled Meeting

Hello Member,

There would be an important meeting scheduled for tomorrow.

Kindly click here to view meeting details

Thank You
Stanford University.

Case ID:9354-61 - random numbers after Case ID:

A quick hover over the link reveals the phishing URL.

Senders email address a big red flag.

From: stanford.edu IT Support Note. <emorfaw@sourcingpartner.com>
Sent: Thursday, November 7, 2019 7:50 AM
To: User <user@stanford.edu>
Subject: Case ID:9354-61

Due to a server error on your e-mail, (user@stanford.edu) (7) incoming messages were delayed.

Log on to your portal to recover your delayed messages
Recover Delayed Messages
2019 Message Center

Your e-mail will be deleted.

From: Stanford University <Zh132889@umconnect.umt.edu>
Sent: Wednesday, September 25, 2019 6:31 AM
To: Harvey, Zachary <zachary1.harvey@umconnect.umt.edu>
Subject: Your e-mail will be deleted.

Hello

This is a final notification to all Stanford University e-mail users, that we are deleting in-active accounts. Validate your email now. Failure to do this within 24 hours, your account will be deleted

Validate Email Account

Sincerely
Stanford University
IT Help Desk

Stanford CS -Payroll Notice

Marked as SPAM in the subject but some were delivered without the warning.

From: Stanford CS - Payroll Service <info@cs.stanford.edu>
Date: Friday, August 2, 2019 at 2:28 PM
Subject: *****SPAM***** Stanford CS -Payroll Notice

1 New Payroll Stanford CS Message

Click https://cs.stanford.edu/hr/payroll.php to READ

Human Resources & Payroll Service
Stanford CS - Stanford University

Campus Administrative Registrar

Phishing email sent from compromised SUNet.

From: Registrar 7/29/2019 8:11:05 PM Desk <ade@stanford.edu>
Sent: Monday, July 29, 2019 1:11 PM
To:
Subject: Campus Administrative Registrar

Hello , user@stanford.edu,

Submit your symester course attendance to (Faculty Dean 7/29/2019 8:11:05 PM) on

Due to the file size, it can not be uploaded to email. Review to authenticate.

COURSE LATE REGISTRATION

Second email from compromised SUNet. Lots of red flags. Why would MSFT Support Team be sending out emails to students?

From: "STANFORD FACULTY DESK 7/29/2019 8:58:37 PM" <abhate@stanford.edu>
Date: Monday, July 29, 2019 at 1:58 PM
subject: COURSE LATE REGISTRATION

Verify your account

Dear user@stanford.edu

Please note that your course registration dues is past due be restricted to campus facilities and classes.
It is imperative to conduct an audit of your information is
present, otherwise your lectures would be denied.

Started now

We invite you to act fast, if you need any help you can
contact our online support.

Sincerely,
MSFT Support Team

Important Info HR Department

A hover over the URL unmasks this as a phishing email. 

Dear user@stanford.edu,

A private document has been sent to you by the Human Resources Department.

Click https://login.stanford.edu to Login to view the document. Thank you!

Stanford University HR.
©2019 Stanford University
----------------------------------------------------------------------------------------------------------------------------------------------------------
CONFIDENTIALITY NOTICE: This email and any attachments may contain confidential information that is protected by law and is for the sole use of the individuals or entities to which it is addressed. If you are not the intended recipient, please destroying all copies of the communication and attachments. Further use, disclosure, copying, distribution of, or reliance upon the contents of this email and attachments is strictly prohibited.