Written by Jordan Barela, Editor-in-Chief   

UPDATE: Shawn Merdinger provides more clarity on a statement in the article. He states that “this particular phishing attack email did not contain a malicious attachment or contain embedded code that would compromise the user.” Merdinger also states that “users should be wary when opening any email, especially attachments like .zip and .doc files, and clicking on links that could lead to malicious webpages that could attack the user’s browser  [and that] maintaining up-to-date anti-virus and system patches can help protect users online, and is the best defense.” More phishing prevention classes are going to be added within the next several weeks and an announcement for signing up will be released soon.

Earlier today, an email was sent out to the VSU community warning of a recent phishing attack through VSU email accounts.

The email, sent out by Shawn Merdinger, Chief Information Security Officer, warned VSU users to not provide any account credentials when clicking on a link to a phishing website.

An email stating that “your valdosta.edu account has been temporarily suspended” and the subject of “Admin”, was sent out to VSU users. The email would go on to state that there is a web maintenance going on and the user would have to verify his or her valdosta.edu account for upgrading.  The phishing attack was attempting to lure users to a site on weebly.com

“The goal was to get recipients to visit a webpage that asked for the user’s password,” Merdinger said.

According to Merdinger, by simply opening the email or clicking the link, there is no threat of attack. The threat of a phishing attack only occurs when the user enters his or her VSU login credentials.

VSU is subject to constant phishing attacks through email. According to Merdinger, Information Security detects possible phishing attacks daily, and Microsoft Office 365, the email provider to VSU, blocks potential threats. Normally the emails will be flagged and sent to a user’s Junk folder. Microsoft Office 365 did not detect this phishing attack and was sent to users’ Inboxes.

“Fortunately, many VSU users recognized the email as phishing and sent it to abuse@valdosta.edu – which is the contact for any suspicious network activity, and Information Security Office staff were able to take action,” Merdinger said.

According to Merdinger, once the attack was detected, the campus firewall prevented anyone on the VSU campus network from entering the phishing website.

Information Security also notified the hosts of weebly.com and the phishing website was taken down.

IT has also stopped any further distribution of the phishing attack through email.

Microsoft Office 365 has also been notified of the phishing attack.

Information Security provides tools to prevent phishing attacks, such as a phishing awareness webpage and a powerpoint.

“We actively strive to mitigate the impact of these threats through a combination of layered defenses, technical countermeasures and educational outreach through security training and awareness activities,” Merdinger said. “We encourage VSU community member to reach out to the HelpDesk and Security contacts for assistance.”