Novel Phishing Messages Targeting Northwestern

Northwestern Information Technology (IT)  is alerting the University community that a new phishing campaign, using attachments containing QR codes, is being sent to faculty and staff at Northwestern.

The subject lines vary; however, the messages are distinct in that there is no text in the body of the email, and they look like the users themselves sent them. These messages also include a PDF, Word, or SVG attachment, which contains QR codes that direct to several external sites with malicious potential. Because of the nature of this phishing campaign, they do not have the “external” flag on the email.

View an example of this phishing message on Northwestern IT’s Recent Phishing Attempts web page.  

Take Action

If you receive one of the messages, do not click on any links, attachments, or QR codes. Immediately report it to your school or department IT staff, or follow these instructions and report it to the Information Security Office at security@northwestern.edu, and then delete the message.

Know the Signs

Knowing what to look out for can significantly reduce your risk of being phished. The Northwestern website provides resources to help identify phishing, including examples of common warning signs.