On May 3, 2017, at 5:05 PM, Susan Brison <[log in to unmask]> wrote:

Hi all,

I just received the following suspicious-looking e-mail sent to the FEAST list and urge you not to open the Doc. unless you know the sender. (Please see warnings from IT people below.)

Best,

Susan

Begin forwarded message:

From: Stephanie Rivera <[log in to unmask]>

Subject: Stephanie Rivera-Berruz has shared a document on Google Docs with you

Date: May 3, 2017 at 3:11:35 PM EDT

To: <[log in to unmask]>

Reply-To: <[log in to unmask]>

Stephanie Rivera-Berruz has invited you to view the following document:

To unsubscribe from the FEAST-L list: write to: mailto:[log in to unmask] or click the following link: http://listserv.jmu.edu/cgi-bin/wa?SUBED1=FEAST-L&A=1

Warnings:

Begin forwarded message:

From: "Ellen L. Young" <[log in to unmask]>

Subject: Do NOT Open Share Document on Google Docs

Date: May 3, 2017 at 4:31:12 PM EDT

To: All Students:;, All Faculty:;, All Staff:;

At approximately 2:30pm today a malicious email began arriving in campus email inboxes purporting to invite recipients to view a google doc via clicking on a link. This link takes the user to a google docs login page. DO NOT click the link. Delete the email. The email appears to be a phishing attack designed to steal google account username and password. It doesn't appear to be phishing for Dartmouth credentials.  ITS is investigating as to the extent of this email attack.

Begin forwarded message:

From: "Jason T. Robinson" <[log in to unmask]>

Subject: ALERT: Dangerous and Convincing Phishing scam

Date: May 3, 2017 at 3:46:38 PM EDT

To: <[log in to unmask]>

Reply-To: "Jason T. Robinson" <[log in to unmask]>

Good afternoon,

There's a very convincing and dangerous phishing scam circulating. Both me and Raphael Krut-Landau received similar emails containing a Google Docs link.

 

See Below:

I first received this message (though

​it originally did not have

 the yellow banner

​, which ​

I added later by marking

​this email ​

as

​a phishing scam

)

​:​

 

<image001.png>

 

Clicking the blue button led me to this page:

<image002.png>

 

I then clicked "[log in to unmask]" (my gmail address) which led me here:

<image003.png>

 

I then clicked the blue link "Google Docs" which showed me this message:

<image004.png>

As you can see, this isn't the real Google Docs. An app has managed to name itself "Google Docs"

​and is soliciting full rights to the user's gmail account.​

 

Looks very dangerous!

 

​Best wishes,​

Raffi