Had an interesting morning with Sunil (Exchange Guru) today at work with an email being sent from a https://spreadsheets.google.com/xxxxxxx url.
Whilst we have not clicked on it other users have and this has then triggered internal emails being sent from her email address book at a rate of about 30 a minute through one of the company email servers.
Eventually the user owned up to filling out a bogus form which was launched from the Google spreadsheet!
If you see this email below DO NOT click the ‘CLICKING HERE‘ link which would be a link to the infected spreadsheet / site.
Subject: 532 MB
Your mailbox is becoming too large. The current size is 532 MB.
Please reduce your mailbox size by CLICKING HERE.
- If you have users that have already clicked it, check your Exchange server tracking logs for emails sent from that user.
- Change the password on the mailbox and recreate a new mailbox for the user as a precautionary measure.
- Send out an email warning users that ICT will never ask for their password, without prior warning.
Bye for now!