On May 16, the Information Security Office carried out an attachment-based phishing campaign by sending an email about “ARAMEX EXPRESS CONSIGNMENT”.
The email was sent from a known sender name but from a false email address <aramex.express.consignment@combase.io>, a generic address that does not correspond with the official website – www.aramex.com.
- The email subject (EXT: Aramex Express Consignment Notification 213596003) is random and generic. Scammers use well-known brands to convince targets to click and take the bate.
- The sender address contains Aramex to trick readers, but (aramex.express.consignment@combase.io), the email domain, does not match Aramex’s official domain (@combase.io).
- The email contained an attachment. The attachment could have contained malicious payloads if sent by a motivated attacker. Downloading such files from unknown parties could result in the immediate execution of malicious code, potentially causing incidents such as data theft, activity monitoring, file deletion or modification, displaying advertisements, and more.
- The Aramex logo used is fake, and if you look closely, you can tell it is different from the original. We urge you to be cautious because logos can easily be spoofed. Cyber attackers use every opportunity to trick recipients into clicking links and opening attachments. Always keep an eye on such tricks and report anything you come across that seems suspicious.
- The message footer contains an agreement disclaimer, terms and conditions that may not exist in Aramex’s typical layout. This trick is used to gain trust by adding a legit feel to the email body.
Always be sure to re-read emails before clicking on links or accessing attachments.
Help keep KAUST safe by reporting phishing emails
Make yourself a harder target for scammers and reduce the amount of scam communications you receive. Reporting suspicious phishing emails to the Information Security Office by clicking on the Report Phishing button on the top right of the page.
The Phish Email Response Breakdown:
For any queries, please contact the information security department at askinfosec@kaust.edu.sa.
