We received reports of an email targeting our users claiming to roll out MFA. TCNJ has used Duo MFA for some time now.
Things to note regarding this attack: The sender address is not a tcnj.edu address. The link in the email points to a non tcnj.edu domain. The landing page contains no TCNJ branding at all, and has an outdated copyright date. An attacker will often use generic terms on these types of pages in order to reuse the site for multiple targets.
Once the page is landed on, the user is asked for their role, username, and password. Once submitted, the next page prompts you to choose an MFA method. Any code can be entered, and the subsequent page will advise that the account has been locked for too many attempts. There is an option to submit a ticket to help desk, which does not actually do anything despite it stating it has done so.
This is a very thorough attack that could be avoided by using the basic methods of checking for indicators in the initial email, such as the email not coming from a tcnj.edu address and the landing page not being a tcnj.edu address (you can hover over the link to determine the destination URL). Attacks like these are becoming more sophisticated and more frequent. Please remain vigilant when checking your emails and report any suspicious messages to phish@tcnj.edu.
Thank you.
