{"id":17340,"date":"2023-01-26T09:35:02","date_gmt":"2023-01-26T14:35:02","guid":{"rendered":"https:\/\/www.marshall.edu\/it\/?p=17340"},"modified":"2023-01-26T13:47:37","modified_gmt":"2023-01-26T18:47:37","slug":"job-scam-alert","status":"publish","type":"post","link":"https:\/\/www.marshall.edu\/it\/2023\/01\/26\/job-scam-alert\/","title":{"rendered":"Job scam alert from compromised MUnet account"},"content":{"rendered":"

Over the past few days there has\u00a0been an increased number of Marshall University user account compromises. This is often in the form of a job offer with a link to a Google form that will ask you to enter your username and password along with your phone number. Once the attacker has your log in credentials they will then text you telling you that your MU account will be disabled unless you reply with a \u201cverification code\u201d. This verification code is the MFA alert from the attacker logging in. If the MFA code is provided to the attacker they will then have full control of the account. Once the threat actor is in our email system, they will start sending out phishing messages from your account to our users. The ultimate goal of the threat actor is to obtain your banking information as a way to \u201cpay\u201d you for a job offer.<\/p>\n

\"\"<\/a>\u00a0 \u00a0\"\"\u00a0<\/a><\/p>\n

Things to look out for:<\/p>\n

\u2022 Do not reply to the text message. The person you are talking to is trying to trick you into giving them your MFA code. If you are contacted by this person, they likely already have your password. You can change your password by going to Self-Service Password Reset – (marshall.edu)
\n\u2022 If you receive an email about a part-time job\/temp position that contains the text \u201cCopy and paste the URL Below into the address bar of your web browser to submit application: ( shorturl.at\/xxxx )\u201d do not go to the URL. If you receive a message like this, forward the message to phishing@marshall.edu or use the Outlook, Report Message, Phishing function.<\/p>\n","protected":false},"excerpt":{"rendered":"

Over the past few days there has\u00a0been an increased number of Marshall University user account compromises. This is often in the form of a job offer with a link to a Google form that will ask you to enter your username and password along with your phone number. Once the attacker has your log in<\/p>\n","protected":false},"author":986,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2,157],"tags":[],"class_list":["post-17340","post","type-post","status-publish","format-standard","hentry","category-infosecalerts","category-phish-bowl"],"acf":[],"fimg_url":false,"_links":{"self":[{"href":"https:\/\/www.marshall.edu\/it\/wp-json\/wp\/v2\/posts\/17340","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.marshall.edu\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.marshall.edu\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.marshall.edu\/it\/wp-json\/wp\/v2\/users\/986"}],"replies":[{"embeddable":true,"href":"https:\/\/www.marshall.edu\/it\/wp-json\/wp\/v2\/comments?post=17340"}],"version-history":[{"count":4,"href":"https:\/\/www.marshall.edu\/it\/wp-json\/wp\/v2\/posts\/17340\/revisions"}],"predecessor-version":[{"id":17358,"href":"https:\/\/www.marshall.edu\/it\/wp-json\/wp\/v2\/posts\/17340\/revisions\/17358"}],"wp:attachment":[{"href":"https:\/\/www.marshall.edu\/it\/wp-json\/wp\/v2\/media?parent=17340"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.marshall.edu\/it\/wp-json\/wp\/v2\/categories?post=17340"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.marshall.edu\/it\/wp-json\/wp\/v2\/tags?post=17340"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}