[unisog] Phishing targeting University Admissions

Michael Holstein michael.holstein at csuohio.edu
Mon Jun 14 12:46:00 GMT 2004


Late last week we saw a "phishing" attack targeting our students using
the enticement of a research assistantship (and a student visa). The
messages are written such that they appear to be from a legitimate
University International Admisions contact, and contain an
as-yet-unidentified "mailer.zip" attachment.

Has anyone else seen these? If/when I get my hands on the original
attachment, I'll post it for analysis.


Michael Holstein
Cleveland State University

-- message body --

Dear Student:

I am pleased to inform you that you have been offered a Research
Assistantship with your department. The modified I20 is being processed
and will be dispatched shortly. Please confirm your acceptance by
sending the mailing charges of $50 for DHL or $15 for Registered mail.

You may use the attached Encrypted Mailer to mail in your detailed
credit card information. Pleae mention your preferred mode of mailing
for your I20 as well. Your I20 will be dispatched as soon as your card
is charged for the required sum.

You are also required to return the I20 that was originally sent to you
as soon as it reaches you. Please note that this is required in order to
re-register you on the SEVIS database without which you will be unable
to attend your Visa Interview.

(attachment: mailer.zip)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
Url : http://www.dshield.org/pipermail/unisog/attachments/20040614/daad83e0/attachment-0004.bin

More information about the unisog mailing list