Security

• Information Security Attack Spotlight
• SharePoint Phishing Campaign
• Immediate Attention Required (URGENT) Phishing Campaign
• Summer Part Time Job at ASU Phishing Campaign
• Student Report Phishing Campaign
• "Downsizing" Phishing Campaign

Information Security Attack Spotlight

SharePoint Phishing Campaign

This article highlights a campaign seen on campus during the second week of May 2026. This malicious phishing campaign saw users receive legitimate SharePoint file sharing emails from threat actors external to our organization. The following details specific components of this email and takes a deeper dive into what indicators exist within the email. 

• #1 – Header information: A solid first stop in identifying potentially malicious emails. In this attack however, the traffic is legitimate SharePoint traffic. This occurs because another organization has either been maliciously created or has had a security incident leading to their users being able to share malicious documents. 

• #2 - “Who” is sharing the file with you: It can be tricky for a threat actor to perfectly manipulate the necessary fields in a malicious email where there are no suspicious gaps. In this instance, that is displayed in the “who” is sharing a file with you.

• #3 – Creating a sense of urgency: Threat actors will lean on publicly available information to help create a sense of urgency and legitimize some content in the attack. In this instance, the threat actor is doing this by manipulating fields to imply this message comes from Dr. Robin Myers. Sometimes traffic like this can be legitimate, so reviewing the message as a whole helps to narrow things down.  

• #4 – Footer information: In this instance, the largest crack in this attacks foundation is the footer information SharePoint has automatically added to their traffic. This clearly conveys that the message originates from SRI SARVARAYA SUGARS LTD's SharePoint, which is not associated with Arkansas State University.  
  

Having reviewed all components of the email and not just the header, we can safely confirm this email is malicious and should be reported to security@astate.edu so that it can be removed from everyone's inbox.  

What You Should Do 

Be Skeptical of Unknown Senders: If you receive an unexpected or unusual email, verify its legitimacy by contacting the sender through a known and trusted channel. 

 

 

Immediate Attention Required (URGENT) Phishing Campaign

This article highlights a campaign seen on campus during the last week of June and first week of July 2026. This malicious phishing campaign saw users receive emails from already compromised internal users with a malicious form to fill out. The following details specific components of this email and takes a deeper dive into what indicators exist within the email. 

• #1 – Header information: A solid first stop in identifying potentially malicious emails. Phishing emails fabricate a sense of urgency in order to trick readers into providing sensitive information. Legitimate emails may sometimes contain these "urgent" key words, but generally these indicate a malicious email.

• #2 - “Who” is emailing you: Where external or unrecognized senders may be easily dismissed by the reader, this particular campaign leveraged a compromised internal account to circumvent that. In this context of university account issues, this sort of email would never come from a student (smail.astate.edu) account. 

• #3 – Investigation of inserted links: Having created a sense of urgency in this email and borrowing "legitimacy" from an internal account, an embedded link to the real threat (a malicious website requesting sensitive information) covers up what would otherwise stand out as suspicious. By hovering over this embedded link instead of clicking on it, the reader can see this directs to a Wix site set up by the threat actor. This is not a service Arkansas State University uses and is another indicator this is malicious. 

• #1 – Website Header information: Shows the visitor that this was a website created on an external service.

• #2 - Fake Logo: Displays a fake Microsoft logo to create a sense of legitimacy. 

• #3 – Further Creating a Sense of Urgency: This form description reinforces that a delay in immediate action will result in unwanted consequences. Not only does this form attempt gain one accounts information from the reader, but it also asks for a second accounts information. This would likely be a secondary account used as a recovery method. 

• #4 – Password Compromise: The form attempts to make the reader believe this is actually a login screen and not just a custom form. Despite this attempt, readers can see through this by the spelling mistakes and the false claims this is "Protected by Admin". 

• #5 - Submit vs Login: Instead of displaying a "login" or other similarly worded phrase to show this isn't a form, it instead shows "submit" which is another indication this is a malicious form and not a secure space to input sensitive information.

Having reviewed all components of the email and the underlying form, we can safely confirm this email is malicious and should be reported to security@astate.edu so that it can be removed from everyone's inbox.  

What You Should Do 

Be Skeptical of Unknown Senders: If you receive an unexpected or unusual email, verify its legitimacy by contacting the sender through a known and trusted channel. 

Summer Part Time Job at ASU Phishing Campaign

This article highlights a campaign seen on campus during the last week of June and first week of July 2026. This malicious phishing campaign saw users receive emails from already compromised internal users with a malicious form to fill out. The following details specific components of this email and takes a deeper dive into what indicators exist within the email. 

• #1 – “Who” is emailing you: Where external or unrecognized senders may be easily dismissed by the reader, this particular campaign leveraged a compromised internal account to circumvent that. In this context of university job postings, this sort of email would never come from a student (smail.astate.edu) account. 

• #2 - Suspicious Links and Forms: Having created an enticing job opportunity in this email and borrowing "legitimacy" from an internal account, a link to the real threat (a malicious Google form) is the next step in this risk. Google forms are not a service Arkansas State University uses and is another indicator this is malicious.

Having reviewed all components of the email and the underlying form, we can safely confirm this email is malicious and should be reported to security@astate.edu so that it can be removed from everyone's inbox.  

What You Should Do 

Be Skeptical of Unknown Senders: If you receive an unexpected or unusual email, verify its legitimacy by contacting the sender through a known and trusted channel. 

Student Report Phishing Campaign

This article highlights a campaign seen on campus during the second week of May 2026. This malicious phishing campaign saw users receive emails from a compromised user account in our organization. The following details specific components of this email and takes a deeper dive into what indicators exist within the attack.

---

Having reviewed all components of the email and not just the header, we can safely confirm this email is malicious and should be reported to security@astate.edu so that it can be removed from everyone's inbox.

---

What You Should Do 

Be Skeptical of Unknown Senders: If you receive an unexpected or unusual email, verify its legitimacy by contacting the sender through a known and trusted channel. 

 

 

"Downsizing" Phishing Campaign

This article highlights a campaign seen on campus during the second week of May 2026. This malicious phishing campaign saw users receive emails from a compromised user account in our organization. The following details specific components of this email and takes a deeper dive into what indicators exist within the email. 

• #1 Sender’s address: The sender’s address appears to come from an official Arkansas State University account (user@astate.edu). However, attackers often compromise legitimate accounts to make phishing emails appear trustworthy. Always remain cautious, even when the message comes from a known or internal email address. Verify suspicious requests through another communication method before responding. 
  
  
• #2 Sense of Urgency: Threat actors commonly create a sense of urgency to pressure recipients into acting quickly without carefully reviewing the email. In this example, the attacker claims the items are in “high demand” and may be claimed soon. This tactic is intended to encourage immediate action and reduce the likelihood that users will question the legitimacy of the message. 
  
  
• #3: Body of the message: The body of the email contains several red flags, including unusual wording, unrelated content, and offers that are uncommon in legitimate university communications. Messages advertising expensive items such as electronics, instruments, or vehicles at unusually low or no cost are commonly used in phishing scams to attract attention and persuade users to respond. 
  
  
• #4 External Contact information: The email instructs recipients to contact the sender using a personal phone number instead of official university communication channels. Threat actors frequently include external contact methods, such as personal phone numbers or non-business email addresses, to continue conversations outside monitored systems and increase the likelihood of financial fraud or credential theft. 

Remember: Even emails sent from legitimate accounts can be malicious if the account has been compromised. Always verify suspicious requests before taking action.  

---

What You Should Do 

Be Skeptical of Unknown Senders: If you receive an unexpected or unusual email, verify its legitimacy by contacting the sender through a known and trusted channel.