ALERTS

Phishing Attempt: New tactic for the "Are you available" emails (Apr 15 10:52 am)

Members of the university community are being targeted by a spear phishing attack where the names of University officials (the President, Chancellor, department chairs, or any UH official), employees, and your colleagues are being used on email messages, to engage the recipient and have them purchase gift cards or other strange activity.
 
Attackers are "spoofing" emails to appear as if they were sent from the person's hawaii.edu account. When you reply to the email, it will be sent to a non-hawaii.edu address. Attackers have previously used free email accounts (gmail.com, my.com, etc) with the university employees name to trick you into responding.
 
These attackers use many variations of emails to try to engage you. They may contain variations of the following:
 
Are you available?
Available?
Are you on campus?
Send me your available active cell number that I can reach you on.
Give me your available text number that I can reach you at .
 
If you receive a message from a UH employee you normally work with, with the above or similar message, do not immediately reply. You should verify the legitimacy of the message separately with the UH employee (not by replying to the message) or through someone else who can validate the request.
 
You should also check to see if there is a non-hawaii.edu "Reply-to" address on the message:
 
1. Log in to Gmail using a web browser.
2. Open the message you'd like to view headers for.
3. Click on the "three horizontal dots" next to the Reply arrow, at the top of the message pane.
4. Select "Show Original".
 
For more information about phishing in mobile device applications, please refer to https://www.hawaii.edu/askus/1708. If you would like to report receiving one of these messages, please refer to https://www.hawaii.edu/askus/898.