There have been a handful of instances where members from our Wake Forest community have been contacted by someone claiming to be from a North Carolina Sheriff’s office. These bad actors have, in some cases, cited individual’s correct addresses, and listed a number of offenses with fraudulent citation numbers trying to collect fines. Protect yourself from these fradulent attacks.

Verify that information is coming directly from a reputable vendor by looking up the company’s phone number. 

Beware of phishing attempts via unwarranted multi-factor authentication (MFA or two-step verification) prompts (known as prompt-bombing). Recent observations indicate that phishers may retrieve a valid username/password combination and enter this valid information into an authentication point. The legitimate user receives the MFA prompt via SMS or an authentication app to confirm their login. If the legitimate user confirms the login, the phisher now has access to the legitimate user’s account. 

The cybersecurity world is investigating implications of a vulnerability discovered around the log4j code, which is used heavily across the internet to allow software applications to “log” activities. Hackers have discovered a way to log a line of malicious code and access servers that run log4j. IS has identified impacted applications and is working with third party services to understand their impact and remediation efforts.

Be alert for fraudulent SMS messages asking users to confirm a payment, followed up by a phone call from the hackers mimicking the fraud department of that bank.

When in doubt, hang up, look up the number of the organization supposedly calling you, and call back.

Be on the lookout for holiday phishing scams. A current scam includes recently-created, funky-looking domains, that look very similar to that of FedEx, impersonating failed deliveries.

Apple has released a new security advisory for iOS and iPadOS users to update their devices to the latest version (15.0.2) after reports of active exploitation of remote code execution and privilege escalation vulnerabilities. We strongly encourage you to apply this update immediately, if applicable.

Apple has released an urgent security update for Mac, iPhone, iPad and Watch users after researchers discovered a vulnerability that gives attackers full access to a device’s camera, microphone, messages, texts, emails, calls and more. We strongly recommend applying this update, if applicable.

We have seen an uptick in phishing scams offering fake jobs such as research assistants and personal assistants. Scammers may impersonate Wake Forest professors or other employees. Be vigilant to check for common red flags. Scammers often use the name of a Wake Forest employee, but have a mismatched or generic Gmail address, instead of… Read More »

Microsoft has released a security patch for the PrintNightmare bug, a recently discovered vulnerability that lets attackers take control of devices. Users are encouraged to update their personal Windows devices as soon as possible.

There has been an uptick in reports of phishing scams submitted within “Contact Us” forms and questionnaires designed for comments and feedback on departmental websites. Recent phishing scams of this nature include: An urgent and intimidating message about “copyrighted” material on your website, with the sender often claiming to be a “certified photographer” who owns… Read More »