Security Alerts & Warnings
This page lists current warnings regarding suspicious email messages and other cybersecurity hazards at the University of Virginia. For guidance on how to secure yourself against these hazards, be sure to visit our tip of the month.
Regarding Suspicious Email Alerts
Messages similar to the suspicious emails listed below may be related to phishing scams, schemes to commit identity theft, or other attempts to compromise users’ machines or personal information.
- If you receive an email similar to any of the suspicious emails on this page, DO NOT respond—delete it immediately!
- Do not click any links in the email, and do not “unsubscribe” or acknowledge the email in any way.
- If you receive an email that appears “phishy” and are unsure if it’s legitimate, and it is not listed below, please report it to us by forwarding it to [email protected].
Security Alerts and Suspicious Items Currently Affecting UVA:
[Posted: Apr 13, 2022 3:49 PM]
From: User, Typical S (mst3k) <mst3k [at] virginia.edu>
Sent: Wednesday, April 13, 2022 3:32:31 PM
Subject: GET PAID TO DRIVE
Name of Company:
Visa Inc.
JOB TITLE:
Earn Money by Driving
JOB DESCRIPTION:
We seek interested applicants to go about their normal routine with the decal of the "2023 FIFA Women's World Cup" on their Vehicles.
Qualification:
• Have a valid driver’s license
• Drive at least 100 miles / weekly
SALARY:
$300 weekly
Additional Information: To apply for this position; interested candidates should contact the HR representatives via wrapstyle [at] autolifemanagement.com<mailto:wrapstyle [at] autolifemanagement.com> with his/her personal email.
Thank you,
Typical S User
BioArchitecture Department
University of Virginia
Charlottesville, Virginia 22904
[Posted: Apr 13, 2022 3:45 PM]
From: "User, Typical (mst3k)" <mst3k [at] virginia.edu>
Date: April 13, 2022 at 3:28:28 PM EDT
Subject: MESSAGE FROM HR DEPARTMENT
Greetings,
You have a message from the Human Resources Department
Click here<hxxps://youkensha.com/wp/wp-content/plugins/wp-file-manager/live/MicrosoftAccount.html> to view your message.
Thank you,
Typical User
BioArchitecture Department
UVA
Charlottesville, Virginia 22904
[Posted: Apr 13, 2022 3:40 PM]
From: User, Typical S (mst3k) <mst3k [at] virginia.edu>
Sent: Wednesday, April 13, 2022 3:34 PM
Subject: PART TIME JOB
Name of Company:
Visa Inc.
JOB TITLE:
Earn Money by Driving
JOB DESCRIPTION:
We seek interested applicants to go about their normal routine with the decal of the "2023 FIFA Women's World Cup" on their Vehicles.
Qualification:
* Have a valid driver's license
* Drive at least 100 miles / weekly
SALARY:
$300 weekly
Additional Information: To apply for this position; interested candidates should contact the HR representatives via wrapstyle [at] autolifemanagement.com<mailto:wrapstyle [at] autolifemanagement.com> with his/her personal email.
[Posted: Apr 10, 2022 8:03 AM]
rom: Typical User <mst3k [at] virginia.edu>
Date: Sun, Apr 10, 2022 at 3:22 AM
Subject: Re: Part-Time Intern!
To:
AHEAD in conjunction with "The University of Virginia" is looking for
dynamic college students interns to join our team as paid interns which
will also gain valuable work experience and we work with interns to gain
academic credit if applicable.
AHEAD is a nonprofit organization dedicated to saving lives and responsible
for providing protection and advocacy for the rights of students with
disabilities
Interns at AHEAD are paid $620 weekly and can work remotely with a
commitment of approximately 8hrs - 12hrs per week and the working hours are
also flexible with the student schedule.
For employment consideration, all qualified applicants are encouraged to
submit their resume and reply to: saraschiller <at> aheads.org with this
information
Name
Age:
Residential Address:
Alternate email (different from school email):
Cell #:
Regards,
AHEAD, The University of VirginiaAHEAD in conjunction with "The University
of Virginia" is looking for dynamic college students interns to join our
team as paid interns which will also gain valuable work experience and we
work with interns to gain academic credit if applicable.
AHEAD is a nonprofit organization dedicated to saving lives and responsible
for providing protection and advocacy for the rights of students with
disabilities
Interns at AHEAD are paid $620 weekly and can work remotely with a
commitment of approximately 8hrs - 12hrs per week and the working hours are
also flexible with the student schedule.
For employment consideration, all qualified applicants are encouraged to
submit their resume and reply to: saraschiller [at] aheads.org with this
information
Name
Age:
Residential Address:
Alternate email (different from school email):
Cell #:
Regards,
AHEAD, The University of Virginia
[Posted: Apr 4, 2022 3:30 PM]
Two critical zero-day vulnerabilities has been identified that require the immediate attention of anyone using a Macintosh computer, iPhone, or iPad.
Threat:
Apple released separate security updates for two vulnerabilities that affect the macOS and iOS and iPadOS operating systems. The zero-day vulnerability that affects both macOS and iOS is tracked as CVE-2022-22675 and one that affects Macs (a macOS zero-day flaw) is tracked as CVE-2022-22674. Successful exploitation of the CVE-2022-22675 vulnerability could allow an application to execute arbitrary code with kernel privileges. Successful exploitation of the CVE-2022-22674 vulnerability could allow an application to read kernel memory. Both of these may have already been exploited.
Permanent mitigation:
If you are running macOS Monterey, update to version 12.3.1 or higher.
If you have an iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation), update to version iOS 15.4.1 and iPadOS 15.4.1 or higher.
Temporary mitigation:
None.
More information:
Apple Security Updates Information - https://support.apple.com/en-us/HT201222
About the security content of iOS 15.4.1 and iPadOS 15.4.1 - https://support.apple.com/en-us/HT213219
About the security content of macOS Monterey 12.3.1 - https://support.apple.com/en-us/HT213220
https://9to5mac.com/2022/03/31/apple-fixes-multiple-zero-day-exploits-with-ios-15-4-1-and-macos-12-3-1/
https://www.techtimes.com/articles/273774/20220401/apple-launches-two-fixes-zero-day-vulnerabilities-affecting-iphones-mac.htm
https://arstechnica.com/information-technology/2022/03/apple-rushes-out-patches-for-two-zero-days-threatening-ios-and-macos-users/
https://threatpost.com/apple-rushes-out-patches-0-days-macos-ios/179222/
[Posted: Mar 31, 2022 4:30 PM]
Action Needed: Critical Vulnerability in Spring Java framework
Threat: CVE-2022-22965: Spring Framework RCE via Data Binding on JDK 9+
UPDATE 4/8/2022: Trend Micro Threat Research today confirmed that this Spring4Shell vulnerability has been exploited by the Mirai botnet.
From the Spring advisory: “The vulnerability impacts Spring MVC and Spring WebFlux applications running on JDK 9+. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.” [emphasis added]
Although the announcement lists specific currently-known requirements for whether a specific installation is vulnerable, it goes on to say ” the nature of the vulnerability is more general, and there may be other ways to exploit it that have not been reported yet.” Continue to monitor the situation no matter what specific Spring configuration you may use.LSPs need to do the following immediately:
- identity whether they support any server systems running the Spring Framework for Java
- mitigate the issue as described in the Spring advisory
Permanent mitigation:
-
Spring Framework 5.3.18 and 5.2.20, which contain the fixes, have been released
- Spring Boot 2.6.6 and 2.5.12 that depend on Spring Framework 5.3.18 have been released.
Temporary mitigation:
-
The Spring advisory contains a multistep workaround for those not able to install the patched versions, but warns that the workaround may leave some loopholes.
More information:
https://www.bleepingcomputer.com/news/security/spring-patches-leaked-spring4shell-zero-day-rce-vulnerability/
https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
https://success.trendmicro.com/dcx/s/solution/000290730?language=en_US
https://www.marketscreener.com/quote/stock/TREND-MICRO-6492622/news/CVE-2022-22965-Analyzing-the-Exploitation-of-Spring4Shell-Vulnerability-in-Weaponizing-and-Executin-40000428/
[Posted: Mar 28, 2022 9:30 AM]
Another Zero-Day flaw in the Chrome web browser for Windows, Macintosh, and Linux computers and Microsoft's Chromium-based Edge browser.
A zero-day flaw has been found in the Chrome web browser used on Windows, Macintosh, and Linux computers. The flaw (CVE-2022-1096) is a high severity flaw on the CVSS vulnerability-rating scale. It is a type confusion weakness in the Chrome V8 JavaScript engine reported by an anonymous security researcher.
Google has released a fix to address this zero-day vulnerability (version 99.0.4844.84). Shortly after Google released Chrome 99.0.4844.84, Microsoft announced that it has updated its Chromium-based Edge browser to version 99.0.1150.55, to resolve CVE-2022-1096.
You can checked for new updates in Chrome by going into Chrome menu > Help > About Google Chrome. Most Chrome and Edge browser will auto-updated AND the update requires the browser to be restarted. Considering the disclosed vulnerability, you should update your Chrome browser to the latest version (at least 99.0.4844.84) or Microsoft Edge browser to the latest version (at least 99.0.1150.55) as soon as possible. These web browser will also auto-check for new updates and automatically install them after the next re-start or launch.
Double-check your browser is up-to-date
Chrome and Edge browsers will in many cases update to its newest version automatically.
However, we recommend you double-check if the update has been applied.
In Chrome, click on Settings then About Chrome
If an update is available, Chrome will show that here and then start the download process. When it's completed, it will ask to relaunch the browser to complete the update.
If the browser is up-to-date, it will say "Google Chrome is up to date" and list the version number. Make sure it's at least 99.0.4844.84
Additional Details
With this update, Google addressed the second Chrome zero-day since the start of 2022, the other one (tracked as CVE-2022-0609) patched last month.
(References: https://www.bleepingcomputer.com/news/security/emergency-google-chrome-update-fixes-zero-day-used-in-attacks; https://www.securityweek.com/google-issues-emergency-fix-chrome-zero-day; https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html )
Please see the Chrome Security Page and the Chrome Releases webpages for more information.
[Posted: Mar 20, 2022 4:50 PM]
From: User, Typical S (mst3k <mst3k [at] virginia.edu>
Sent: Sunday, March 20, 2022 1:37 PM
Subject: EMERGENCY
Your mailbox storage has reached 98% on the email server. Visit OutlookStorage Access Page<hXXps://f190fc3a.sibforms.com/serve/MUIEAJrKWr7IFcHqJYxHk_e9JINRgJPmaCXsKVacyv82UwrCVicQYzDLLIO1C6AGq3vsxGtgsTm1oVM6zzVXcGlMnk0sZcrK3Kma387tk7XPBOFQ35kLJPAZCV9zj-wfo7EKpC63JV16LWzqz1_cCBUTGGW-tmvbo3m4JcpKDkbTnIlXDwAZBlX46vKP5-gp7i94mzOReftBFVbz> to adjust your Mailbox storage.
Note: To access your Outlook account for upgrade a notification call will come through your phone, kindly answer the call and then press 1 on your phone to continue.
Warm Regards,
Webmail Administrator
[Posted: Mar 8, 2022 4:00 PM]
Zero-Day flaws in the Firefox web browser for Windows, Macintosh, and Linux computers
Two zero-day flaws have been found in the Mozilla Firefox web browser used on Windows, Macintosh, and Linux computers. The flaws (CVE-2022-26485 and CVE-2022-26486) have been described as use-after-free issues impacting the Extensible Stylesheet Language Transformations (XSLT) parameter processing and the WebGPU inter-process communication (IPC) Framework. Both are critical severity flaws on the CVSS vulnerability-rating scale.
Mozilla acknowledged that "We have had reports of attacks in the wild" weaponizing the two vulnerabilities.
In light of active exploitation of the flaws, if you have a Firefox browser, it is recommended to upgrade as soon as possible to these versions: Firefox 97.0.2, Firefox ESR 91.6.1, Firefox for Android 97.3.0, Focus 97.3.0, or Thunderbird 91.6.2.
Most Firefox browsers will auto-updated and the update requires the browser to be restarted.
Double-check your Firefox Browser is up-to-date
Firefox will in many cases update to its newest version automatically.
However, we recommend you double-check if the update has been applied.
In Firefox, click on Settings then General and scroll down to Firefox Updates
If the browser is up-to-date, it will say "Firefox is up to date" and list the version number. Make sure it's at least Firefox 97.0.2, Firefox ESR 91.6.1, or Firefox for Android 97.3.0
Additional Details
One vulnerability (CVE-2022-26485) - Removing an XSLT parameter during processing could lead to an exploitable use-after-free situation. (Use-after-free bugs – which could be exploited to corrupt valid data and execute arbitrary code on compromised systems.)
The other vulnerability (CVE-2022-26486) - An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added the two Firefox zero-day vulnerabilities, along with nine other bugs, to its Known Exploited Vulnerabilities Catalog, requiring federal agencies to apply the fixes by March 21, 2022.
(References: https://thehackernews.com/2022/03/2-new-mozilla-firefox-0-day-bugs-under.html, https://www.bitdefender.com/blog/hotforsecurity/mozilla-firefox-97-0-2-update-addresses-two-actively-exploited-zero-day-flaw, cert.civis.net/en/index.php?action=alert¶m=CVE-2022-26485 and cert.civis.net/en/index.php?action=alert¶m=CVE-2022-26486).
Please see the Mozilla Security Advisory webpage for more information.
[Posted: Mar 7, 2022 1:53 PM]
Sent: Sunday, March 6, 2022 3:35:21 PM
To: UVA User <[email protected]>
Subject: Payroll Notifications for [email protected] on 07 Mar 2022
|
||||||
| Copyright © 2022. | THE UNIVERSITY OF VIRGINIA | All Rights Reserved |
[Posted: Feb 24, 2022 8:52 PM]
From: Package Info <noreply [at] productshipping-hub9.co>
Subject: Service Update for 24th Feb #GEESQ-24-14295109
Date: February 24, 2022 at 3:11:38 PM EST
To: "mst3k [at] virginia.edu" <mst3k [at] virginia.edu
Your services has been renewed
This emails confirms the renewal of your services with G-Squad. We are glad to inform you that your plan with us has been renewed for $395.49. Please review the summary of your renewal:
Renewal ID
GEESQ-24-14295109
Renewal date
24-Feb-2022 09:15:55 EST
Registered Email – confirmed
[email protected] <mailto:[email protected]
Description Users Qty Amount
Geek Secure Premium
04 01 395.49 USD
Subtotal 395.49 USD
Total 395.49 USD
Payment 395.49 USD
Method used
Credit/Debit Card
Issues with this Email?
You have 24Hrs. from the date of the renewal to cancel your plan.
Help-Desk: +1 (xxx) 300-0118
Please do not reply to this email. To get in touch, reach Help-Desk
Not sure why you received this email? Learn more
unsubscribe
[Posted: Feb 24, 2022 9:00 AM]
From: virginia.edu Mail Admin <NOREPLY [at] virginia.edu>
Sent: Wednesday, February 23, 2022 7:27 PM
To: User, Typical S (mst3k) <mst3k [at] virginia.edu>
Subject: virginia.edu Email Security Alert!!!
|
|
||||||||||||
|
Vision : To be a leading world-class manufacturer of preferred sugar and associated products.
Mission : Sustainable production of Sugarcane, manufacture and market of quality sugar and associated products for the delight of Customers .
Help save paper and consider our environment - do you need to print this e-mail?
SonySugar is committed to keeping the World Green by Keeping it on the Screen.
[Posted: Feb 18, 2022 10:41 AM]
From: "Garland, Maran K (mkg9d)" <mkg9d [at] virginia.edu>
Date: Friday, February 18, 2022 at 10:16 AM
To: "User, Typical (mst3k)" <mst3k [at] virginia.edu>
Subject: Personal Assistant Position
Dear Student Faculty and Staff,
There is an open position a business executive is currently out of the states for conference and business purposes he is in need of a very honest person to assist him during this period.
Duties:
Monitor Calls and reply to emails.
Receive and make payment to business clients.
Flight booking.
Payment : $400
Location: USA
Applicants must be 18 and above.
CLICK HERE<hxxp://harp-primrose-4hrt.squarespace.com/> To submit an application.
Maran K. Garland
434.964.7150
[Posted: Feb 18, 2022 10:39 AM]
From: "Lewis, Tanika (tl9jh)" <tl9jh [at] virginia.edu>
Date: 18 February 2022 at 14:26:04 GMT
To: Typical User <mst3k [at] virginia.edu>
Subject: UVA Employment
Work remotely at your convenience from home or school this semester. Students and staff of UNIVERSITY OF VIRGINIA are qualified to apply, and payment is $400 weekly! Kindly CLICK HERE<hxxps://1kea.wufoo.com/forms/z1qo1hjt0y2mdd9/> to submit an application.
Thanks.
[Posted: Jan 26, 2022 4:45 PM]
A critical vulnerability (CVE-2021-4034) has been identified that requires the immediate attention of most Linux users. Please prioritize this issue.
Information about this vulnerability, who it affects, how to search for it, and mitigation strategies if you find it, are on our webpage: Critical vulnerability in most default Linux installations
We want to make sure that finding and fixing this vulnerability is high priority for all Linux administrators. Linux users who are not administrators should contact their administartor to make sure it is being fixed.
Thank you for helping to keep everyone’s data and information at UVA secure.
[Posted: Jan 18, 2022 5:15 PM]
Multiple people at UVA have reported that they have received a text message that looks something like the one below.
This is "smishing" - it's like "phishing" but over SMS text so it's called "smishing"
So treat it like a phishing email - Don't click on the link.
Notice the weird writing, such as putting parenthesis around the "3" and not making "virus" plural.
The link is a odd as well, not a well-known link shortener, and if you hovered on it, it doesn't go where it states.
So ignore this text!
[Posted: Dec 29, 2021 8:41 AM]
From: virginia.edu:12/29/2021 <info [at] rkvalve.com>
Sent: Wednesday, December 29, 2021 5:59:55 AM
To: User, Typical S <mst3k [at] virginia.edu>
Subject: virginia.edu_Notification:(Wednesday, December 29, 2021)
virginia.edu WEBMAIL
Hello mst3k,
Your mst3k [at] virginia.edu password is set to Expire today,
Wednesday, December 29, 2021
You can change your password or continue using same password below
Keep Same Password <hxxp://xn.54nl7.everesthimalayansd.com/.#.aHR0cDovL3JheWFubGFuLmNvbS93cC1hZG1pbi9pbWFnZXMvc3l1LyNhbGc2bkB2aXJnaW5pYS5lZHU=>
virginia.edu Support
[Posted: Dec 13, 2021 4:15 PM]
If you and/or your folks are not already working on finding/remediating the Apache log4j Java vulnerability (CVE-2021-44228), please prioritize this issue. It is a critical zero-day exploit.
When this vulnerability is exploited, the bad guy can run commands on your computers or servers, steal data, and/or use your computers to laterally pivot to other computers or servers.
Information about this vulnerability, who it affects, how to search for it, and mitigation strategies if you find it are on our webpage: Action Needed: Critical Vulnerability in Widespread Java Logging Library
We want to make sure that finding and fixing this vulnerability is high priority for everyone.
Thank you for helping to keep everyone’s data and information at UVA secure.
[Posted: Nov 18, 2021 4:07 PM]
From: Virginia -053100 <kazash [at] gvsu.edu>
Sent: Thursday, November 18, 2021 3:36 PM
To: Typical User mst3k [at] virginia.edu>
Subject: Covid Test#56470
Importance: High
Attached copy of your test result.
Thanks.
[Posted: Nov 13, 2021 7:32 PM]
From: "John William Betts, III" <jwb286 [at] cornell.edu>
Date: November 13, 2021 at 1:05:15 PM EST
Subject: University Payroll Services invited you to view the files "Regarding 2021 payroll schedule "on Payroll Services.
University Payroll Services invited you to view the files "Regarding your 2021 payroll schedule "on Payroll Services.
View file<hxxps://nortegasconcepcion.com/.odrth/st8923/blackbord.php>
Enjoy!
University Payroll Services
Pages
Report an Information
Security Incident
Please report any level of incident, no matter how small. The Information
Security office will evaluate the report and provide a full investigation if appropriate.