The safety and security of the Hunter College community and its New York City campuses is the Office of Public Safety's highest priority.
Learn More About Campus SafetyThis will allow the Office of Public Safety to respond to the scene with immediate assistance. Public safety officers will call 911 if necessary to provide required information and directions.
CIS has confirmed that a phishing email was received by some recipients in the Central Office. While CIS continues its investigation, containment and remediation activities, please review the following information and take action as appropriate.
Security Threat Identification / Symptoms
A phishing email with a subject of “CUNY : 'Earn $500 weekly'” There may be other versions. Do NOT click or respond to the request within the message. An illustrative sample of the message is included at the bottom of this alert.
If you think you have already been impacted by this security threat
If you received this message or one like it, delete it and do not respond or reply to the message. If you already responded to the phishing email, immediately contact the CIS Service Desk at service.desk@cuny.edu or 646-664-2311
Recommended User Action
Security Threat Explained
This phishing message attempts to lure recipients into opening a fake job offer attachment and respond by email with personal information.
Security Alert Updates
CIS will send an update if/when there is more information to share.
Robert N. Berlinger, CISSP
CHIEF INFORMATION SECURITY OFFICER CITY UNIVERSITY OF NEW YORK security.cuny.edu
Fraudulent phishing email sample:
The FBI’s Criminal Investigative Division and the National Center for Missing & Exploited Children (NCMEC), in coordination with the Office of Private Sector (OPS)/Information Sharing and Analysis Unit (ISAU) prepared this Academia Engagement Report (AER) to inform school officials who maintain regular contact with students about the increase in financially-motivated sextortiona cases targeting minor males.
In this scheme, the predator, posing online as a young female, contacts the victim over any online platform used to meet and communicate, such as a game, app, or social media account, and uses deception and manipulation to convince the victim, typically a young male between 14 and 17-years-old, to engage in sexually explicit activity over video. The predator then reveals they secretly recorded the explicit activity and threatens to post the videos online or distribute them to the victim’s friends or family unless the victim sends the predator money or gift cards.
The exploitation can be quick, and extortion may occur within hours of the first contact. Reporting indicates paying the predator does not guarantee the sextortion will end; in most cases where the victim provided payment, the predator typically responded with additional monetary demands, and in some cases, distributed the victim’s illicit photographs or videos to their friends or family despite receiving payment to prevent that from happening. Additionally, some victims have reported they were told to follow certain other suspected predator social media accounts when they indicated they did not have the ability to pay the predator. This is potentially a way for the predators to lend legitimacy to online accounts used to perpetrate this scheme.
An account with no or few friends or followers would appear more suspicious than an account with more friends or followers which would have a greater appearance of being a legitimate account of a real individual. This could also be a way to widen the pool of potential targets for predator accounts by giving them visibility and access to the victim’s circle of friends and followers, increasing victimization of other minors.
The threats and continued harassment by these predators have resulted in the suicides of multiple minor male victims. The FBI is providing the following case examples:
In 2021, the FBI’s Internet Crime Complaint Center (IC3) received over 18,000 sextortion-related complaints, with losses over $13.6 million. This number reflects all types of sextortion reported, not just this particular scheme.
Tips to Prevent Victimization
The FBI provides the following tips to teachers and educators to help protect their students online:
Recognizing Warning Signs
Victims of sextortion may exhibit the following:
The sextortion may happen quickly or there may be no behavioral changes, so it is important to have open communication with minors about their online activity.
Supporting Sextortion Victims
Minors are often embarrassed or scared to report victimization, something predators depend on to encourage compliance. Further, predators often tell victims they will be arrested for sending child sexual abuse material if they report anything. This is not true. In an effort to encourage victims to come forward, reinforce the following messaging to minors:
Reporting Sextortion
The coercion of a minor by an adult to produce child sexual abuse material carries severe penalties, which can include up to life sentences for the offender. To stop victimization, minors typically have to report it to someone – normally a parent, teacher, caregiver, or law enforcement officer. The embarrassment children feel from the activity they were forced to engage in is what typically prevents them from reporting. Sextortion offenders may have hundreds of victims around the world, so coming forward to help law enforcement identify the offender may prevent countless other incidents of sexual exploitation to that victim and others. If you believe someone you know is the victim of sextortion:
Find more information about sextortion.
This Academia Engagement Report was disseminated from OPS’s ISAU. Direct any requests and questions to your FBI Private Sector Coordinator at your local FBI Field Office.
CIS is advising the CUNY community regarding so-called “Secret Shopper” and “Gift Card” scams. Please familiarize yourself with these scams.
Security Threat Identification / Symptoms
Emails containing an offer of employment to be a “secret shopper” or “personal assistant.” Such unsolicited offers are scams. Sometimes the message is sent from a CUNY email address whose account has been compromised or references a CUNY “job placement” office, to lend “legitimacy” to the email.
Recommended User Action
Security Threat Explained
In these scams, which are often directed at students, an unsolicited secret shopper or personal assistant employment offer is sent by email, sometimes appearing as if sent by a fellow student.
When a victim responds, the scammer will typically arrange to send the victim a (fake) check and request that it be cashed or deposited immediately. The check amount is represented as both pay for work to be performed and expense money to accomplish requested services. The victim is then typically instructed to purchase gifts cards and send back pictures of them with the PIN codes visible. The scammers use the codes to spend the value of the gift cards.
It can take the bank weeks to determine that the check is fake, and when that happens the victim is left responsible for any money advanced and suffers a financial loss from the previously purchased, and now worthless, gift cards.
The fact that legitimate secret shopper jobs exist bolsters the credibility of the scam. The offer email may also refer to a CUNY “job placement” office.
What is a Secret Shopper
Some marketing/merchandising companies legitimately hire “secret” or “mystery” shoppers as a quality assurance measure. Such shoppers anonymously purchase requested items in a store and then report on the experience. Typically, the shopper is reimbursed and sometimes the shopper keeps the purchase and/or receives a small payment. The vast majority of unsolicited secret shopper or personal assistant job offers, however, are scams.
Secret Shopper Scam Recruitment Examples
CUNY has recently experienced several instances of fraudulent, COVID-themed phishing attempts. The intent of this alert is to raise awareness of this ongoing campaign. Please review the following information which can help you recognize similar phishing attempts should one be directed to you.
Security Threat Identification/Symptom
Be on the lookout for phishing email in which COVID-19-related grant money, benefits or a stay-at-home job is offered. Emails may be entitled “Important/Urgent Message from the College Finance Department,” “COVID-19 Benefits” or similar. The email or email attachment contains a link to “sign up” for the fraudulent offers. Please note that the sender of the phishing email could be from a CUNY email account that has been compromised. Samples of several such phishing emails are included at the bottom of this message.
If you think you have already been impacted by this security threat
If you believe you are a victim of an online scam or malware campaign, please report it to the CUNY CIS Service Desk (service.desk@cuny.edu, 646-664-2311) and consider the following actions:
Recommended User Action
Security Threat Explained
Such phishing messages request that the recipient click on a link in the email or in an attachment that requests personal or login/password credential information to be entered. The associated website is fraudulent. Information entered in response to the phish is harvested by malicious actors to be used to conduct identity theft, account compromise, data theft, etc.
Security Alert Updates
CIS will send an update if/when there is more information to share.
Novel Version of SHARPEXT Malicious Browser Extension Attributed to North Korea
Summary
The Federal Bureau of Investigation (FBI) is releasing this Private Industry Notification to alert private sector partners to a novel version of the SHARPEXT malware, attributed to the North Korean advanced persistent threat (APT) Kimsuky. As of September 2022, the novel SHARPEXT malware was capable of infecting devices through web browser extensions on Firefox, as well as on previously-reported browsers Microsoft Edge, Google Chrome, and Naver Whale.
Threat
After a victim is compromised, APT Kimsuky actors deploy the SHARPEXT– malicious browser extension, which enables them to directly inspect and exfiltrate data from a victim’s webmail account. As of September 2022, the FBI identified a novel Firefox-based version of SHARPEXT, whose capabilities were previously documented in open source reports against Microsoft Edge, Google Chrome, and Naver Whale. The process of installing the malicious extension begins with the execution of PowerShell scripts that exfiltrate the following key Firefox profile-related files:
Upon execution, a script placed on the victim’s Startup folder replaces these files in the victim’s default Firefox profile as part of the following set of actions:
FBI analysis revealed the extension to be a HTTP traffic inspector, with the ability to pull and download arbitrary JavaScript code from a command and control server. The extension also contains a variety of helper functions, which the FBI assesses are meant to support code that the extension could download and run when executed.
Recommendations
The FBI recommends the blacklisting of the following SHARPEXT command and control servers:
The FBI further recommends its partners search for the misspelled custom directory name, “extentions,” within their customers’ default Firefox profile directory in %APPDATA%.
For additional information regarding SHARPEXT, please see:
Reporting Notice
The FBI encourages recipients of this document to report information concerning suspicious or criminal activity to their local FBI field office or the FBI’s 24/7 Cyber Watch (CyWatch). Field office contacts can be identified at www.fbi.gov/contact-us/field-offices. CyWatch can be contacted by phone at 855-292-3937 or by e-mail at CyWatch@fbi.gov. When available, each report submitted should include the date, time, location, type of activity, number of people, type of equipment used for the activity, the name of the submitting company or organization, and a designated point of contact. Press inquiries should be directed to the FBI’s National Press Office at npo@fbi.gov or (202) 324-3691.
Social Media Scam
How It Starts
This scam usually begins on social media or through receiving a random text.
On social media, the suspect will create a fake account and then build up “friends” to give the account credibility. They will then have friends in common with you, and will use these mutual friends as part of the ploy to gain your trust. Often, the fake account is female and the victim is male. The fake account will begin a dialogue with the victim that turns sexual in nature and will send explicit photos to the victim. They will then ask for explicit photos in return.
Please note that the same scenario can happen over text message. The suspect will pretend to have texted the wrong number but then start a conversation to develop rapport and gain your trust.
Whether on social media or through text, another variation of this scam is a third party will enter the conversation. They will claim to be a parent and accuse you of sending explicit content to a minor. They will threaten to call law enforcement and have you arrested if you do not pay.
Photos and Extortion
If you send explicit photos, the extortion starts. They will demand money and threaten to send your photos to all your friends, school, work and other public domains if you do not pay.
Even if you pay, they will continue the threats and will ask for more money.
If you did not send any photos, they will use your available social media photos to create fake explicit photos of you. They will then threaten to release them the same way if you do not pay.
What You Can Do to Prevent This
If You Are Being Threatened with Extortion
Most suspects are located overseas and it may be difficult for local law enforcement to prosecute them. It is likely you will be referred to the FBI. While there is little chance of recovering any money that may have been sent, reporting the crime may help to ensure it does not happen again.
Learn about our processes, procedures and services, and find out how you can help keep the Hunter College community safe.
See All Public Safety Policies
Our public safety officers are on duty 24-hours a day across all nine campuses.
Learn How to Find Us