May 2025-Stats
UWRF had less than 1% click rate on this month's phishing campaign!
Phishing Simulation Explained:
Breaking Down the Phishing Attack
The phishing simulation was sent to all University of Wisconsin-River Falls employees including student employees.
Here is a copy of the simulated May phishing message that was sent. You can find indicators in each that help identify it as a phishing message.
Spot the Spoofed Email Address
Checking the email address is one of the best ways you can tell if a message is a phishing attack. By inspecting the email address, you can see it is not from zoom.com. The email name is spoofed to show up with the name “Zoom,” but the actual email address goes to <zoom.notification@internalitsupport.com>. When compared, a real email is from Zoom has a domain of <@zoom.us>.
Call to Actions
The button “Enable ZoomAI” is meant to tempt you into clicking, which in practice would lead to a fake login page or malware.
Legitimate companies don’t roll out features without prior notice or context. If you are not familiar with the service being offered, you can always google/search their website and try to find the info independently of the link in the message.
Look for Errors!
Scammers often have slight misspellings to attempt getting past email security filters.
For example, you can see a grammar mistake with “We’ve turned AI on it's head” this is an incorrect use of “it’s” instead of “its.”
Phishing emails often have small grammar or style issues that legitimate companies would catch.
Report any branded email that has errors as that is likely a phishing attack.
Fake Physical Address
The Zip code listed in the email does not match the real zip code of Zoom HQ.
Report as Phishing
Keep in mind for any email you receive and always be suspicious of unexpected messages. You were not expecting this message. Don’t let their urgency cause you to act without thinking.
While DoTS is able to block the vast majority of malicious messages it is possible for phishing attacks to slip through, so you need to be careful.
By reporting the message, you are helping us keep everyone safe. Nothing bad happens by reporting a message as phishing. If you aren’t sure something is safe, please let us know by using the Report Message feature in Outlook and selecting “report phishing.”