Security Updates

The UCT Computer Security Incident Response Team (CSIRT) is investigating a new phishing attempt that appears to be from Norton, entitled Subscription Invoice ID ADH20220209KED, but is sent from an @gmail.com email address. The recipient is informed that their Norton 365 Total Protection has been renewed and will be automatically deducted. 

Please do not respond to the email or take any action.

Managing unusual or suspicious email messages

In the case of an email attachment:

• DO NOT CLICK THE ATTACHMENT IN THE EMAIL.
• If you clicked the attachment in the email, DO NOT enter your details. Instead, please close the attachment and run a full anti-virus scan of your machine.

Where links are provided:

• DO NOT CLICK THE LINK. Instead, delete the email.
• If you clicked the link and/or entered your details, your account may be compromised. This puts the UCT network and UCT assets at risk. Please follow these steps:

1. On a device that you know to be free of malware and infection, change your password immediately. For assistance with password management at UCT, visit http://icts.uct.ac.za and search for “passwords”.
2. Run a full anti-virus scan of your machine.
3. Send an email to the IT Helpdesk informing them that your details may have been compromised, but that you’ve changed your password and completed the scan.

Please remember:

• Don't ever reply to emails, messages, or calls that request personal information – especially usernames and passwords.
• NEVER share your password or PIN with anyone – not even an ICTS representative, or representatives of your bank, mobile network, or other service providers.
• Do not open attachments unless you can verify the sender and the nature of the attachment.
• Don't open emails of unknown origin.
• Don't click on links in emails if you cannot recognise where the link directs you.
• Don't reply to spammers asking them to remove you from their mailing list.  Replying just confirms your email address as valid, which encourages them to send you more spam.
• Don't forward chain letters or marketing material.
• Please check the announcements on the ICTS and CSIRT websites for the latest alerts. If your suspicious email differs to the one in the announcement, please report it to the IT Helpdesk at icts-helpdesk@uct.ac.za. You can report any other cybersecurity issues to the CSIRT at csirt@uct.ac.za.

The UCT Computer Security Incident Response Team (CSIRT) is investigating a phishing attempt containing an attachment that is a POP for February statement. The recipient is then asked to send an updated statement. The phishing email is sent from a @mz.ab-inbev.com email address. 

What do I do?

If you receive such an unexpected email request, even if it looks like it is from one of your contacts or a legitimate company, please do not click the links or open attachments. First contact the individual to verify that they sent it.

If they did not send it, please inform the IT Helpdesk immediately by sending the email on to icts-helpdesk@uct.ac.za. You can then delete the email. The same advice applies to any suspicious emails you receive on your UCT account.

If you have already clicked the link in the email, DO NOT enter your details if prompted. Instead, run a full antivirus scan of your machine. Then, on a device that you know to be free of malware and infection, change your UCT password. Send an email to the IT Helpdesk informing them that your details were compromised, but that you have changed your password.

Please remember:

• Don't ever reply to emails, messages, or calls that request personal information – especially usernames and passwords.
• NEVER share your password or PIN with anyone – not even an ICTS representative, or representatives of your bank, mobile network, or other service providers.
• Do not open attachments unless you can verify the sender and the nature of the attachment.
• Don't open emails of unknown origin.
• Don't click on links in emails if you cannot recognise where the link directs you.
• Don't reply to spammers asking them to remove you from their mailing list.  Replying just confirms your email address as valid, which encourages them to send you more spam.
• Don't forward chain letters or marketing material.
• Please check the announcements on the ICTS and CSIRT websites for the latest alerts. If your suspicious email differs to the one in the announcement, please report it to the IT Helpdesk at icts-helpdesk@uct.ac.za. You can report any other cybersecurity issues to the CSIRT at csirt@uct.ac.za.

The UCT Computer Security Incident Response Team (CSIRT) is investigating an email invitation to the Master Orchestra International Concerto Competitions 2022. The phishing email is sent from a info@masterorchestra.it email address. 

What do I do?

If you receive such an unexpected email request, even if it looks like it is from one of your contacts or a legitimate company, please do not click the links or open attachments. First contact the individual to verify that they sent it.

If they did not send it, please inform the IT Helpdesk immediately by sending the email on to icts-helpdesk@uct.ac.za. You can then delete the email. The same advice applies to any suspicious emails you receive on your UCT account.

If you have already clicked the link in the email, DO NOT enter your details if prompted. Instead, run a full antivirus scan of your machine. Then, on a device that you know to be free of malware and infection, change your UCT password. Send an email to the IT Helpdesk informing them that your details were compromised, but that you have changed your password.

Please remember:

• Don't ever reply to emails, messages, or calls that request personal information – especially usernames and passwords.
• NEVER share your password or PIN with anyone – not even an ICTS representative, or representatives of your bank, mobile network, or other service providers.
• Do not open attachments unless you can verify the sender and the nature of the attachment.
• Don't open emails of unknown origin.
• Don't click on links in emails if you cannot recognise where the link directs you.
• Don't reply to spammers asking them to remove you from their mailing list.  Replying just confirms your email address as valid, which encourages them to send you more spam.
• Don't forward chain letters or marketing material.
• Please check the announcements on the ICTS and CSIRT websites for the latest alerts. If your suspicious email differs to the one in the announcement, please report it to the IT Helpdesk at icts-helpdesk@uct.ac.za. You can report any other cybersecurity issues to the CSIRT at csirt@uct.ac.za.

The UCT Computer Security Incident Response Team (CSIRT) is investigating a phishing attempt promoting a bitcoin website. The email entitled, Join Now, is sent from a sales@agmrbay.co.za email address. 

What do I do?

If you receive such an unexpected email request, even if it looks like it is from one of your contacts or a legitimate company, please do not click the links, open attachments, or contact the person using the details provided in the email. Verify it by directly contacting the individual using their officially-listed UCT contact details, instead of those provided in the message.

If they did not send it, please inform the IT Helpdesk immediately by sending the email on to icts-helpdesk@uct.ac.za. You can then delete the email. The same advice applies to any suspicious emails you receive on your UCT account.

If you have already clicked the link in the email, DO NOT enter your details if prompted. Instead, run a full antivirus scan of your machine. Then, on a device that you know to be free of malware and infection, change your UCT password. Send an email to the IT Helpdesk informing them that your details were compromised, but that you have changed your password.

Please remember:

• Don't ever reply to emails, messages, or calls that request personal information – especially usernames and passwords.
• NEVER share your password or PIN with anyone – not even an ICTS representative, or representatives of your bank, mobile network, or other service providers.
• Do not open attachments unless you can verify the sender and the nature of the attachment.
• Don't open emails of unknown origin.
• All emails sent from external senders have a yellow bar at the top of the email warning you that the email is from outside the UCT network and should only be actioned if you know and trust the source.
• Don't click on links in emails if you cannot recognise where the link directs you.
• Don't reply to spammers asking them to remove you from their mailing list.  Replying just confirms your email address as valid, which encourages them to send you more spam.
• Don't forward chain letters or marketing material.
• Please check the announcements on the ICTS and CSIRT websites for the latest alerts. If your suspicious email differs to the one in the announcement, please report it to the IT Helpdesk at icts-helpdesk@uct.ac.za. You can report any other cybersecurity issues to the CSIRT at csirt@uct.ac.za.

Cybercriminals use various ways to get access to your information or even the UCT network. A recent example currently under investigation by the UCT Computer Security Incident Response Team (CSIRT) involves an email that appears to be from Vice-Chancellor requesting assistance. Those who receive the email, entitled EMERGENCY, are asked to respond with their WhatsApp number and await further instructions on what they need to do.

In this case, even though the message appeared to be from the Vice-Chancellor, an @gmail.com email address was used. It is recommended that your UCT email address be used for internal and UCT-related communication.

All emails sent from external senders have a yellow bar at the top of the email warning you that the email is from outside the UCT network and should only be actioned if you know and trust the source. To help you determine legitimate emails from scams, take note of tell-tale signs such as the external email warning, suspicious email addresses, or urgent requests.

What should I do?

It is highly unlikely that the the Vice-Chancellor will send you such an email. If you get such an email, do not respond to it. Verify it by directly contacting the individual using their officially-listed UCT contact details, instead of those provided in the message.

Create a new email message in Outlook and click To (where you would normally insert the email address. 

• If you're using the Outlook desktop client, enter the name in the Search field and click the arrow. All the applicable names will appear in the list below.
• In Outlook Web App, click To and select Default Global Address List. As you start typing the name in the search field, the applicable names will appear below.

Remember these security tips

• Never reply to emails, messages, or calls that request personal information – especially usernames and passwords.
• If you receive a call, message, or email out of the blue from your bank or a service provider indicating that there is a problem with your account, thank the caller then hang up. Call the institution directly using the number listed on their website and verify if the call is legitimate or a scam. Never call back using details provided by the caller. You never know who will be on the other side. Some hackers run professional cybercrime companies, including helpdesk centres that sound very convincing.
• If you receive a call about an issue that you never logged and you’re asked to give the caller remote access, do not take any action. Rather hang up and report the issue to your service provider.
• Make sure you have anti-virus installed on your devices. At UCT, you have access to McAfee which you can install on your UCT-owned and personal computers.
• Keep your operating system, software, and anti-virus up to date at all times. The latest security updates contain patches and fixes to keep your devices and information secure.
• Please do not forward the message to your contacts. Report it to the IT Helpdesk at icts-helpdesk@uct.ac.za, who will then conduct the necessary investigations. Learn more about how you can report information and cybersecurity-related issues to the UCT CSIRT.

The UCT Computer Security Incident Response Team (CSIRT) is aware of a hoax SMS doing the rounds where Discovery members are requested to update their personal and payment details via the telephone number provided. Failure to do so will result in their services being discontinued.

Discovery is aware of the hoax SMS and has advised that we do not follow this request. If we need to update any information related to our policies, we should do so on the Discovery website.

View an overview of additional Discovery-related scams doing the rounds.

Remember these security tips

• Keep track of the latest phishing attempts on campus via the UCT Phish Bowl.
• NEVER share your password or PIN with anyone – not even an ICTS representative, or representatives of your bank, mobile network, or other service providers.
• Don’t ever reply to emails, messages, or calls that request personal information – especially usernames and passwords.
• If you receive a call, message, or email out of the blue from your bank or a service provider indicating that there is a problem with your account, thank the caller then hang up. Call the institution directly using the number listed on their website and verify if the call is legitimate or a scam. Never call back using details provided by the caller. You never know who will be on the other side. Some hackers run professional cybercrime companies, including helpdesk centres that sound very convincing.
• If you receive a call about an issue that you never logged and you’re asked to give the caller remote access, do not take any action. Rather hang up and report the issue to your service provider.
• Make sure you have anti-virus installed on your devices. At UCT, you have access to McAfee which you can install on your UCT-owned and personal computers.
• Keep your operating system, software, and anti-virus up to date at all times. The latest security updates contain patches and fixes to keep your devices and information secure.
• Please do not forward the message to your contacts. Report it to the IT Helpdesk at icts-helpdesk@uct.ac.za, who will then conduct the necessary investigations.

The UCT Computer Security Incident Response Team (CSIRT) is currently investigating new spear phishing attacks doing the rounds on campus. The emails appear to be sent from Directors of UCT departments. One version, entitled ASSISTANCE NEEDED, asks if the recipient has availability and to "kindly" respond with their contact number so that they can engage on WhatsApp. Another version, entitled QUITE URGENT AT THE MOMENT, asks if the recipient is "currently on duty". 

In both cases, even though the messages appeared to be from senior UCT management, different @gmail.com email addresses were used. It is recommended that your UCT email address be used for internal and UCT-related communication.

All emails sent from external senders have a yellow bar at the top of the email warning you that the email is from outside the UCT network and should only be actioned if you know and trust the source. To help you determine legitimate emails from scams, take note of tell-tale signs such as the external email warning, suspicious email addresses, or urgent requests.

What should I do?

It is highly unlikely that senior management will send you such emails. If you get such an email, do not respond to it. Verify it by directly contacting the individual using their officially-listed UCT contact details, instead of those provided in the message.

Create a new email message in Outlook and click To (where you would normally insert the email address. 

• If you're using the Outlook desktop client, enter the name in the Search field and click the arrow. All the applicable names will appear in the list below.
• In Outlook Web App, click To and select Default Global Address List. As you start typing the name in the search field, the applicable names will appear below.

Remember these security tips

• Never reply to emails, messages, or calls that request personal information – especially usernames and passwords.
• If you receive a call, message, or email out of the blue from your bank or a service provider indicating that there is a problem with your account, thank the caller then hang up. Call the institution directly using the number listed on their website and verify if the call is legitimate or a scam. Never call back using details provided by the caller. You never know who will be on the other side. Some hackers run professional cybercrime companies, including helpdesk centres that sound very convincing.
• If you receive a call about an issue that you never logged and you’re asked to give the caller remote access, do not take any action. Rather hang up and report the issue to your service provider.
• Make sure you have anti-virus installed on your devices. At UCT, you have access to McAfee which you can install on your UCT-owned and personal computers.
• Keep your operating system, software, and anti-virus up to date at all times. The latest security updates contain patches and fixes to keep your devices and information secure.
• Please do not forward the message to your contacts. Report it to the IT Helpdesk at icts-helpdesk@uct.ac.za, who will then conduct the necessary investigations. Learn more about how you can report information and cybersecurity-related issues to the UCT CSIRT.

The UCT Computer Security Incident Response Team (CSIRT) is investigating a phishing attempt that apears to be from SARS but is sent from a Gauteng provincial government email address. The email has no subject but serves as a notice that if an account is not settled it will result in black listing.. 

What do I do?

If you receive such an unexpected email request, even if it looks like it is from one of your contacts or a legitimate company, please do not click the links, open attachments, or contact the person using the details provided in the email. Verify it by directly contacting the individual instead of using the details provided in the message.

If they did not send it, please inform the IT Helpdesk immediately by sending the email on to icts-helpdesk@uct.ac.za. You can then delete the email. The same advice applies to any suspicious emails you receive on your UCT account.

If you have already clicked the link in the email, DO NOT enter your details if prompted. Instead, run a full antivirus scan of your machine. Then, on a device that you know to be free of malware and infection, change your UCT password. Send an email to the IT Helpdesk informing them that your details were compromised, but that you have changed your password.

Please remember:

• Don't ever reply to emails, messages, or calls that request personal information – especially usernames and passwords.
• NEVER share your password or PIN with anyone – not even an ICTS representative, or representatives of your bank, mobile network, or other service providers.
• Do not open attachments unless you can verify the sender and the nature of the attachment.
• Don't open emails of unknown origin.
• All emails sent from external senders have a yellow bar at the top of the email warning you that the email is from outside the UCT network and should only be actioned if you know and trust the source.
• Don't click on links in emails if you cannot recognise where the link directs you.
• Don't reply to spammers asking them to remove you from their mailing list.  Replying just confirms your email address as valid, which encourages them to send you more spam.
• Don't forward chain letters or marketing material.
• Please check the announcements on the ICTS and CSIRT websites for the latest alerts. If your suspicious email differs to the one in the announcement, please report it to the IT Helpdesk at icts-helpdesk@uct.ac.za. You can report any other cybersecurity issues to the CSIRT at csirt@uct.ac.za.

The UCT Computer Security Incident Response Team (CSIRT) is investigating a new phishing attempt that asks you to click a button in an email entitled Your package is being held. You are required to provide further instructions on what to do with the package by paying the displayed amount. The email was sent from Post office <support@posteoffice.freshdesk.com>. 

What do I do?

If you receive such an unexpected email request, even if it looks like it is from one of your contacts or a legitimate company, please do not click the links. First contact the individual to verify that they sent it.

If they did not send it, please inform the IT Helpdesk immediately by sending the email on to icts-helpdesk@uct.ac.za. You can then delete the email. The same advice applies to any suspicious emails you receive on your UCT account.

If you have already clicked the link in the email, DO NOT enter your details if prompted. Instead, run a full antivirus scan of your machine. Then, on a device that you know to be free of malware and infection, change your UCT password. Send an email to the IT Helpdesk informing them that your details were compromised, but that you have changed your password.

Please remember:

• Don't ever reply to emails, messages, or calls that request personal information – especially usernames and passwords.
• NEVER share your password or PIN with anyone – not even an ICTS representative, or representatives of your bank, mobile network, or other service providers.
• Do not open attachments unless you can verify the sender and the nature of the attachment.
• Don't open emails of unknown origin.
• Don't click on links in emails if you cannot recognise where the link directs you.
• Don't reply to spammers asking them to remove you from their mailing list.  Replying just confirms your email address as valid, which encourages them to send you more spam.
• Don't forward chain letters or marketing material.
• Please check the announcements on the ICTS and CSIRT websites for the latest alerts. If your suspicious email differs to the one in the announcement, please report it to the IT Helpdesk at icts-helpdesk@uct.ac.za. You can report any other cybersecurity issues to the CSIRT at csirt@uct.ac.za.