Security Advisory

The University has recently observed smishing (SMS phishing) attempts in which threat actors impersonate IT Support and contact students and employees via text message. These messages often claim there is an issue with your university account, email, or Multi-Factor Authentication (MFA) setup and request that you provide your MFA code or approve an authentication request.

These messages are fraudulent. The IT support or university will never ask you to provide your MFA code, password, or approve an unexpected authentication request.

Threat actors use social engineering techniques to create a sense of urgency and convince users to disclose sensitive information. If successful, attackers can use stolen credentials and MFA codes to gain unauthorized access to university accounts and services.

What to Look For

Be cautious of text messages that:

• Claim to be from IT Support, the Service Desk, Microsoft, or the University asking for your MFA code, password, or verification code.
• Ask you to approve an MFA prompt that you did not initiate.
• Create a sense of urgency by claiming your account will be locked, suspended, or compromised.
• Contain suspicious links directing you to sign in to your account.
• Request personal or confidential information through text message.

Impact

• Steal usernames, passwords, and MFA codes.
• Gain unauthorized access to university accounts.
• Send additional phishing messages from compromised accounts.
• Access sensitive University information.

Resolution

If you receive a suspicious text message:

• Do not reply to the message or click on any links.
• Do not provide your password or MFA code.
• Do not approve unexpected MFA requests. If you receive an MFA prompt that you did not initiate, deny the request and report it using the reporting option available in the Duo Mobile app or the Microsoft 365 Authenticator notification on your phone.
• Take a screenshot of the message and report it to the Service Desk.
• Block the number and delete the message after reporting it.

If you have already interacted with the message, clicked a link, shared your credentials, or approved an unexpected MFA prompt:

1. Change your password immediately  https://app2.uregina.ca/perl/chpass.pl and contact the Service Desk as soon as possible to reset the MFA.
2. Choose a password that is:

1. • Completely different than your previous password.
   • Not used anywhere else.
   • Does not contain your previous password.

1. Inform the Service Desk of any information you may have provided.

Monitor your account for unusual activity.

Remember

Your MFA code is like a password. Never share it with anyone.

The IS Service Desk or university will never ask you for:

• Your password.
• Your MFA code.
• Approval of an unexpected MFA prompt.

If someone requests any of the above, treat the request as suspicious and report it immediately.

Resources

Please contact the IS Service Desk if you have any questions or require assistance:

Email: Service.Desk@uregina.ca
Phone: 306-585-4685
In Person: ED 137 or Archer Library Commons

• Take cyber security awareness training available to all faculty and staff on Beauceron https://www.uregina.ca/is/security/training/training-register.html