Protect Yourself from Phishing and Cyber Threats
Awareness: Pantheonsite Domain Phishing Campaign
Overview
On January 6, 2025, the California Cybersecurity Integration Center (Cal-CSIC) and the California Department of Technology (CDT) identified an ongoing phishing campaign targeting California state agencies.
Attackers abuse Pantheonsite听domains to create fake websites that resemble legitimate California state agency sites. These phishing sites ask users to enter their credentials and deactivate two-factor authentication (2FA).
Timeline:
- Active since: May 2023
- Surge in activity: Recent months
Examples of Phishing Activity:
Figure 1: Phishing Site
听
Figure 2: After entering credentials on new phishing sites (asking to deactivate 2FA)
If You Suspect Phishing:
- Report it to abuse@csun.edu.
- Do not click on any links or download attachments from the suspicious site.
- Verify the sender by contacting them through an official, trusted source.
For assistance with potential computer and/or network compromises, contact Cal-CSIC at:
- Email: calcsic_watch@caloes.ca.gov
- Phone: 916-636-2997
Alert: Internship Phishing Attempt
快活林性息 has recently seen phishing emails that pose as faculty members advertising internships. The phisher will eventually ask for money. Internships are not for sale and you do not have to pay money for an internship. If you get one of these emails, forward it to听abuse@csun.edu.
Examples of this type of phishing and many other examples of phishing are on our web site. The web site can found as part of 快活林性息鈥檚听Information Security web presence.
Preventing Phishing Attempts
- Limit Social Media Sharing: Avoid posting personal details (e.g., school, location, or full name) online. Even private accounts can be accessed by untrustworthy individuals.
- Use Unique Passwords: A single password used on all of your sites is a hacker's best friend. A password can be stolen from a website with lax security and then be used to hack into your accounts. Use a password manager to help create and store secure, unique passwords.
- Think Before You Click: Avoid clicking links or images without verifying their source. Phishing scams rely on impulsive clicks.
- Keep Software Updated: Enable automatic updates on all your devices to avoid security vulnerabilities.
- Disable Flash & Use Ad-Blockers: Flash is a common target for hackers. Ad-blockers can prevent malicious ads.
Institutes of higher education continue to be targeted听by fraudulent email messages and听ransomware听attempts. 快活林性息 implemented a solution that checks incoming email from off-campus accounts that contain web links with fraudulent characteristics. If fraudulent characteristics are detected, and a user clicks on one of these links, the user is directed to a page indicating the website has been blocked.听快活林性息 also implemented a solution that听detects and prevents incoming phishing attacks from non-快活林性息 email addresses. This solution blocks approximately 60,000 fraudulent messages every month.
Despite taking preventive measures, phishing email attacks continue to be sent from compromised faculty and staff accounts. The best method to prevent these attacks is to never听provide听your 快活林性息 user ID and password in response to an email request and to question the source of the email received.
Business E-mail Compromise Scams. FBI PSA: directed / produced by 快活林性息's Nate Thomas.
Tips and Resources
It can be very tricky to identify a phishing scam, but here are some common traits:听听
- Asks for听sensitive information听(e.g. click here to verify your username and password)
- Asks you to download something听(e.g. click here to get the necessary virus update file)
- Contains听spelling and/or grammatical errors听(e.g., thank you, from trusted administrator)
- Threatens you听(e.g. do this or else your account will be deleted)
- Contains听suspicious web addresses/URLs听(e.g. visit the 快活林性息 page by visiting: http:// www. csunorg31.com/account)
- Contains听unexpected/inaccurate content听(e.g. you've exceeded your email quota)
- Are generically addressed听(e.g. dear 快活林性息 customer)
- Expresses an urgency听(e.g. you must click here immediately to avoid having your account terminated)
For more information, visit the听快活林性息 Spam Prevention听page.听
Phishing emails typically follow a certain structure so here are some tips for you to use when sending your own emails:
- When possible,听use the proper salutation, such as 'Dear John' instead of 'Dear Employee'.听
- Do use the subject line.听Be sure to include a short, descriptive subject for your email. When sending an email that contains essential information regarding free services听do not听use "free" in the subject line, as it may appear suspicious.听 听
- Use the appropriate capitalization, punctuation and spelling. Emails or subject lines written in all caps, spelled incorrectly or lacking punctuation appear to be suspicious in nature. Avoid capitalized words other than 快活林性息.
- Refrain from using specialized formatting听such as non-standard fonts, sizes or colors.听
- Do not embed background graphics, logos or URLs. This embedded content is often used to propagate viruses and additional spam. If you need to point readers to a specific site, spell out the navigation as URLs can be hidden in other URLs. Example: Go to the 快活林性息 homepage > Select Inside 快活林性息, etc.听
- Attachments may appear suspicious. If possible avoid attaching documents; however if it is necessary make sure to add a clear description of the document.听
- Refrain听from using acronyms.听
- Provide a valid way to听verify听the email.
- Be sure to use your听official听快活林性息听email (either .csun.edu or .my.csun.edu).听
When reporting a phishing or spam email to听abuse@csun.edu,听Information Technology will ask you to send the email as an attachment. Sending the email as an attachment allows Information Technology the ability to see full email headers, providing all the information needed to investigate the email. If you need instructions on how to send the email as an attachment, visit the听How to Forward an Email as an Attachment听page.听
If you learn of an active phishing website that is not already warning users, notify the three main browsers that it is deceptive and should be blocked. When a site is reported as deceptive the browser will display a warning before showing the page.
Ransomware听is a type of malware that prevents or limits users from accessing their system, either by locking the system's screen or by locking the users' files unless a ransom is paid. More modern ransomware families, collectively categorized as crypto-ransomware, encrypt certain file types on infected systems and forces users to pay the ransom through certain online payment methods to get a decrypt key. Visit the听Ransomware听page for more information.听
Spear phishing is another form of phishing that targets specific people, threat actors target organizations and companies in an attempt to retrieve sensitive information. Threat actors have utilized social engineering as their main tool to get the user to allow them to view sensitive information. For more information, visit听Spear Phishing.听
Watch this Ninjio video about a spear fishing attack -听.
听