While the scam primarily targets personal banking accounts, it affects the broader post-secondary community, including students, parents, guardians, faculty, and staff. Fraudsters are exploiting trust in financial institutions and creating a false sense of urgency to pressure victims into approving transactions themselves. In several cases, banks refused to refund the money because the customer approved the charges during the call, even though they were tricked.

How the scam works:

1. You get a call that shows your bank’s real phone number on caller ID.
2. The caller says there is fraud on your account and asks you to open your banking app, or read back a code sent by text, to “stop” the charges.
3. You are actually approving payments to a school you have no connection to.
4. The criminals have already collected money from international students by offering them “discounted” tuition. Your card is used to pay that tuition.

Warning Signs:

• Requests to use your personal credit card or bank account to assist another person's tuition payment.
• An unexpected call claiming to be from your bank's fraud department.
• Pressure to act immediately to "stop" suspicious transactions.
• Requests to approve banking app notifications while on the phone.
• Requests to provide one-time passcodes or verification codes received by text or email.
• A caller who insists you remain on the line while reviewing your banking account.
• Offers to pay tuition on someone's behalf at a discount or through an unofficial arrangement.

Remember, Caller ID can be spoofed and should NOT be trusted as proof of identity.

If you think you've been targeted:

1. Contact your bank or credit card provider immediately.
2. Request that your cards be blocked or replaced if necessary.
3. Ask your financial institution to investigate the transactions and initiate any available dispute or chargeback process.
4. Report the incident to your local police service.
5. File a report with the Canadian Anti-Fraud Centre at .
6. Keep records of all communications, case numbers, statements, and correspondence.

Criminals no longer rely solely on stealing passwords. Increasingly, they manipulate victims into approving transactions themselves. Taking a moment to verify who you are speaking with and independently contacting your bank can prevent significant financial loss.

Stay vigilant and help raise awareness by sharing this information with family members, especially students and parents who may be involved in managing tuition payments.

Questions or Concerns?

Reach out to 91��ɫ's Information Security Team by emailing infosec@yorku.ca.

The post Growing Tuition Payment Scam Targets Canadians Through Fake Bank Fraud Calls appeared first on Information Security.

The Information Security team at 91��ɫ has received multiple reports from community members receiving fake “order confirmation” or “subscription renewal” emails that  appear to be sent from legitimate companies like Staples, Microsoft, and Dell. The emails employ a new attack vector, targeting users via Telephone-Oriented Attack Delivery (TOAD).

This tactic is also known as callback phishing, where attackers send a legitimate-appearing order confirmation email that does not usually contain a phishing link, but rather tells recipients to call a toll-free number to cancel the order or dispute the fees charged.

Once a victim calls the number, they are connected to a fraudulent “customer support” representative who attempts to convince them to disclose sensitive information such as usernames, passwords, credit card or banking information. Attackers may also attempt to instruct victims to download remote access software on their device.

Attackers are shifting the interaction from the typical phishing email to a phone conversation in an attempt to bypass traditional email security controls that would otherwise be detected. Once connected via phone call, they will try to manipulate victims in real-time using urgency, fear, and social engineering techniques.

These scams usually try to impersonate well-known brands and services in attempt to instill a sense of legitimacy; examples include:

• Online orders from Dell, Staples, Amazon, or BestBuy
• Subscription renewals from Microsoft, Geek Squad, Norton, or McAfee
• Payment confirmations for products/services that you did not purchase

The warning signs are often the same: an unexpected order or invoice for a subscription you didn’t renew, a claim that you were charged for something you never purchased, pressure to act quickly, and instructions to call the phone number provided in order to resolve the issue and retrieve funds.

Some examples of these scam emails are shown below:

What to do if you receive this scam:

• Do not click links or open attachments in unexpected order confirmation emails.
• Do not call any phone number provided in the message. If you are concerned that a charge may be legitimate, check your bank statement and verify the charge with your financial institution and/or by contacting the company using their contact information listed on their official website.
• Verify the transaction independently. Log in directly to your account through the company's legitimate website or mobile app rather than using links in the email.
• Never provide passwords, multifactor authentication codes, banking details, or remote access to anyone in response to an unsolicited email or phone call.
• Report suspicious emails using the phishing report button or forward them to the Information Security team for review.
• If you already interacted with the message, clicked a link, entered credentials, or shared sensitive information over the phone, contact the Information Security team immediately.

The post Unexpected Order Confirmation? It Could be a Phishing Scam appeared first on Information Security.

Despite conventional phishing techniques remaining effective, cyber criminals continue looking for new ways to compromise users' accounts. One lesser-understood method to do so is through device codes. Traditional authentication involves a username and a password; this can be extremely inconvenient or even impossible for devices lacking a keyboard or other way for users to input their credentials. Smart TVs and Internet-of-Things (IoT) devices are examples of "input-constrained" devices which may need to log into applications.

Device code authentication offloads authentication to a different device, such as a user's smartphone or computer. The "input-constrained" device's application generates a code for users to input on their alternative device and advise users to visit a legitimate link on the application developer's website (Microsoft, Netflix, etc.). Users will then go through their usual authentication process on a legitimate login page- username, password, 2-factor authentication. Afterwards, a token will be provided to the "input-constrained" device's app giving it access to the user's account.

However, a device using device code authentication does not actually need to be "input-constrained".

How does Device Code Phishing Work?

Consider the typical case of an attacker attempting to compromise a user's Microsoft 365 account:

1. An attacker visits a Microsoft application and initiates a device code authentication. They receive a device code. The attacker does not require a username or password to do this; the authentication is not against anyone in particular at this stage.
   
2. The attacker contacts their target via message, email, or phone call. Alternatively, codes can be generated when a user visits a malicious or compromised website under the guise of "verification". Their objective is to convince the user to visit the official Microsoft device code login page and enter the attacker's code.
   
3. The target enters the device code and then goes through their regular Microsoft authentication flow on the official Microsoft website, including 2-factor authentication if enabled.
   
4. Microsoft issues a token to the attacker's device granting access to the target's account.

Why is Device Code Phishing Effective?

There are several reasons why this technique is effective:

• Users are unlikely to understand what device code authentication is, or how it works.
  
• The attack occurs exclusively on legitimate domains/websites. A user suspicious of fake or look-a-like websites would only encounter trusted, official websites during the attack.
  
• Generative AI is capable of crafting convincing, personalized phishing messages to send users. AI can also address users' replies in an attempt to alleviate suspicion and provide additional, fake context around the device code request.
  
• Traditional login-related alerts may not work against device code phishing attacks due to authentication taking place on users' regular, trusted devices rather than the attacker's devices.

How can You Protect Yourself Against Device Code Phishing?

Many of the usual behaviours and defenses that protect against phishing and scams apply:

• Treat unsolicited messages asking you to enter a code with extreme suspicion. If you did not request a code, you should not be receiving one.
  
• Verify the identity of senders (email addresses, phone numbers). Consider the possibility that a trusted contact could have been compromised to send you phishing messages, or that a phone number was "spoofed" to appear as a trusted number.
  
• Carefully review warnings prior to clicking on links or entering codes; the Microsoft device code input page states that entering a code will grant account access to whoever generated it.
  
• Report suspicious messages to 91��ɫ IT, 91��ɫ's Information Security team, or trusted colleagues for a second opinion.

Questions?

91��ɫ's Information Security team can be reached at infosec@yorku.ca. Phishing emails can be reported to phishing@yorku.ca. General inquiries around IT can be directed to askit@yorku.ca.

References

• https://www.microsoft.com/en-us/security/blog/2026/04/06/ai-enabled-device-code-phishing-campaign-april-2026/?msockid=047ea62ec25164ad1aeeb0d0c38065a2
• https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/device-code-flow-the-gift-that-keeps-on-giving-%E2%80%94-to-attackers/4540949

The post Hacked WITHOUT Exposing Your Password? You NEED to Know about Device Code Phishing! appeared first on Information Security.

On May 21st, we’re introducing the new, home-grown, 91��ɫ Phish Alert button for undergraduate students in Gmail. This button lets you report suspicious or unwanted phishing messages with one quick click. It will replace the previous Cofense Reporter, but the reporting process stays just as simple.

Why We’re Making This Change

Phishing emails are one of the most common ways attackers try to steal personal information. By moving to a home‑grown reporting tool, we can improve service reliability and capture additional email artifacts, improving our team’s response capabilities.

How This Benefits You

• Faster protection: Your reports go directly to 91��ɫ’s Information Security Team for quick review.
• Stronger security: Better reporting helps us spot and stop phishing campaigns earlier.
• Same simple experience: One click, and you’re done.

How to Use It

When you see a suspicious email:

1. Open the message.
2. Click the 91��ɫ Phish Alert button in your email toolbar.
3. The phishing report will be sent to the Information Security team for further investigation.

Where to Find More Information

If you’d like to learn more about phishing, how to spot it, or how the new reporting tool works, visit our website here.

The post A New Phish Reporting Solution for Students - 91��ɫ Phish Alert appeared first on Information Security.

Canvas remains available and University teaching and learning activities can continue as usual. We will share any changes if Instructure’s guidance or system status changes.

No action is required at this time, other than remaining alert for phishing or other suspicious messages.

Instructure has posted the following .

91��ɫ/Schulich is prioritizing assessing this incident and will update this message and share relevant updates and guidance through our usual communications channels as information becomes available.

Canvas is an externally-hosted platform. 91��ɫ and Schulich School of Business systems were not affected.

The University is monitoring the incident response and will provide additional information and guidance as more details become available.

91��ɫ is committed to protecting privacy and maintaining the trust of our students and community. We are working with Instructure to understand how this happened and what actions Instructure are taking to prevent future incidents.

We encourage all students, faculty, and staff to remain vigilant:

Questions: For questions about this notice or Canvas use at Schulich, please contact canvasincident@schulich.yorku.ca

Beware of Phishing: Cybercriminals often use stolen contact information to send convincing “phishing” emails. Be wary of any message, even those appearing to come from Schulich, 91��ɫ, or Canvas that asks you to click a link, provide a password, or share personal details. A reminder: 91��ɫ will never ask for your password by email, text, or phone.

Verify Communications: If you receive a suspicious message regarding this incident, do not click any links. Report it directly to infosec@yorku.ca.

The post Canvas by Instructure: Important Notice appeared first on Information Security.

What is ClickFix?

ClickFix is a social engineering technique where attackers compromise legitimate websites and replace normal verification steps such as CAPTCHAs with fake prompts, and instruct users to run malicious commands on their computers. These commands often involve opening the Windows Run dialog or PowerShell and pasting in a script that appears to “fix” a problem or “verify” the user. In reality, the script is being used to download malware that compromises your device.

This technique has been observed across higher‑education institutions and is increasingly used to deploy malware families such as , a backdoor capable of downloading additional payloads, collecting system information, and maintaining persistence on the device.

How does it Work?

ClickFix attacks follow a simple pattern:

1. You click on a link from a search result or ad, and as the page loads, a strange-looking CAPTCHA or pop‑up appears unexpectedly.
   
2. Instead of asking you to click images or check a box, it tells you there’s a “problem” and you need to run a command to continue.
   
3. The page instructs you to open Windows + R, PowerShell, or Terminal and paste in a line of text.
   
4. That command silently downloads malware onto your device. In many cases, it installs a backdoor such as CORNFLAKE.V3, which can download additional malicious files onto your system, collect system information, and stay hidden on your machine.

Because the attacker convinces you to run the command, your device treats it as a trusted action, making it much harder for security tools to block.

How Can I Spot a ClickFix Attempt?

Exercise caution towards any unfamiliar website, email, or popup that:

• Asks you to open Windows Run (Windows + R)
• Tells you to paste a command into PowerShell or Terminal
• Claims you must run a script to “fix,” “verify,” or “continue”
• Appears immediately after clicking a search result or ad
• Displays a CAPTCHA that looks unusual, low‑quality, or out of place

If you encounter instructions like:

“Press Windows + R and paste the following command…”

…it is almost certainly malicious.

If you suspect you may have interacted with a ClickFix prompt, please report it to the Information Security Team immediately (infosec@yorku.ca).

References:

• https://unit42.paloaltonetworks.com/preventing-clickfix-attack-vector/
• https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/
• https://cloud.google.com/blog/topics/threat-intelligence/analyzing-cornflake-v3-backdoor/

The post Fake CAPTCHA, Real Threat: ClickFix Social Engineering Attacks appeared first on Information Security.

The impersonation site is NOT affiliated with 91��ɫ and should be considered malicious. Do NOT enter your username, credentials, Duo 2FA codes, or any other personal information on this site as this may result in unauthorized access to your accounts.

The fraudulent site uses the URL <www.yorkuonline.com>, an image is shown below for reference:

Red Flags to Watch Out For

Unsolicited messages directing you to log in:
Messages claiming your account will be disabled, your mailbox is full, or your access is expiring are common tactics used to lure users to fake login pages.

Suspicious URL:
Official 91��ɫ login pages always use domains ending in yorku.ca. Any variation such as extra characters, misspellings, unfamiliar subdomains should be treated as suspicious.

Unexpected login prompts:
If you are asked to “verify your account”, “update your credentials” or “restore access” after clicking a link you did not expect, this is a strong indicator of a phishing attempt.

Requests for Duo/MFA passcodes:
91��ɫ will never ask you to enter Duo 2FA codes outside of the official login process. Any site requesting your passcode directly should be considered malicious.

If you encounter any emails or messages directing you to this site, please report it using the Report Phishing button or forward the message to phishing@yorku.ca.

If you have already entered your credentials into the malicious site, change your password immediately by visiting . If you have any questions or concerns, please contact infosec@yorku.ca.

The post Phish Alert - Malicious Website Impersonating 91��ɫ appeared first on Information Security.

Key details of the phishing email:

Subject: "Winter 2026 Term Commencement – Important Information"
Date: January 5, 2026
Sender: admin@gpaindustria.onmicrosoft.com

Red Flags to Watch Out For:

Suspicious sender email: The sender's email address is not associated with 91��ɫ’s official IT services (email was NOT sent from an @yorku.ca address).
Urgency and financial motivation: The email pressures you to act quickly, using the false promise of disclosing details pertaining to a fake Fall Bonus in exchange for submitting personal information.
Request for personal details: 91��ɫ would NEVER ask for passwords, Duo/MFA passcodes, or other sensitive information via email.

What to Do:
Do not respond to this email or provide any personal information.
Do not click any links or open attachments that may be included.
Report the email: If you received this phishing attempt, please report it using the Report Phishing button or forward it to phishing@yorku.ca

The post Phish Alert - Winter 2026 Term Commencement – Important Information appeared first on Information Security.

Severity level:-

CVSS Score: 10.0 / Critical.

Description:- The vulnerability has been identified in React Server Components (also known as React.js or ReactJS) “Flight” protocol affecting React 19 ecosystems and frameworks that implement it, most notably Next.js. The issue arises from insecure deserialization that allows unauthenticated remote code execution (RCE). When a malicious actor crafts a specific HTTP request, the flaw in React's deserialization process can enable them to execute arbitrary code on an unpatched server.

Affected Versions :-   

• React Server Components versions 19.0, 19.1.0, 19.1.1, and 19.2.0
• Next.js version 14.3.0-canary.77, 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7 and 16.0.7

Impact:-

An unauthenticated attacker could craft a malicious HTTP request to any Server Function endpoint that, when deserialized by React, achieves remote code execution on the server. Exploit code is publicly available and exploitation is actively occurring.

Resolution:-

Administrators should upgrade to the latest patched version in their release line.

Reference:-

UIT Information Security

The post Remote Code Execution Vulnerability in React and Next.js Frameworks appeared first on Information Security.

Red Flags to Watch Out For:

Suspicious sender email: The sender's email address is not associated with 91��ɫ’s official IT services (email was NOT sent from an @yorku.ca address).
Urgency and financial motivation: The email pressures you to act quickly, using the false promise of disclosing details pertaining to a fake Fall Bonus in exchange for submitting personal information.
Request for personal details: 91��ɫ would NEVER ask for passwords, Duo/MFA passcodes, or other sensitive information via email.

What to Do:
Do not respond to this email or provide any personal information.
Do not click any links or open attachments that may be included.
Report the email: If you received this phishing attempt, please report it using the  or forward it to phishing@yorku.ca

The post Phish Alert - Notification of Eligibility: Fall 2025 Bonus at 91��ɫ appeared first on Information Security.

91��ɫ's Information Security team is aware of a spike in false positive antivirus detections by Windows Defender against benign activity in the powershell.exe and svchost.exe processes. The issue is believed to have begun around the evening of November 26th, 2025, and had widespread impact on November 27th, 2025. Impacted computers displayed periodic desktop notifications and may have prevented webcams from functioning. A sample false positive detection is pictured below:

The cause of the issue appears to have been an issue in a recent version of Microsoft Defender's security intelligence (cloud-based updates). The issue is believed to have impacted other organizations, not just 91��ɫ. Microsoft has acknowledged the issue and confirmed that it was fixed in security intelligence version 1.441.548.0.

Most computers should have received a patched security intelligence update by the time of writing as they are generally updated automatically. However, users still experiencing this issue can update their security intelligence manually. To do so, open the Windows Security app, go to Virus & threat protection, click on Protection updates, and click on Check for updates.

The post Microsoft Defender False Positive Detections on PowerShell and svchost: Win32/AMSI_Patch.A appeared first on Information Security.

The post Phish Alert - Important: Your Eligibility for the Fall 2025 Bonus Payment / Notification of Eligibility: Fall 2025 Bonus at 91��ɫ appeared first on Information Security.

Key details of the phishing email:

• Subject:��16.89 % Salary Increase Letter Wednesday, November 5, 2025
• Sent:��November 5th, 2025
• Sender: harry.ruda@utoronto.ca

The email falsely claims to provide salary increase information enclosed in an attached PDF file titled "91��ɫ (1).pdf", which later directs users to submit their credentials and personal information into a malicious webpage.

Red Flags to Watch Out For:

1. Suspicious sender email:��The sender's email address is not associated with 91��ɫ’s official IT services (email was��NOT��sent from an @yorku.ca address).
2. Urgency and financial motivation:��The email pressures you to act quickly, using the false promise of disclosing details pertaining to a salary increase.
3. Request for personal details:��91��ɫ would��NEVER��ask for passwords, Duo/MFA passcodes, or other sensitive information via email.

What to Do:

• Do not respond��to this email or provide any personal information.
• Do not click��any links or open attachments that may be included.
• Report the email:��If you received this phishing attempt, please report it using the����or forward it to��phishing@yorku.ca

The post Phish Alert - 16.89 % Salary Increase Letter Wednesday, November 5, 2025 appeared first on Information Security.

"Watchtower Alert: Password Issue Detected

If you receive the phishing email described above or any other similarly suspicious emails claiming to be from 1Password, please do��NOT��click on any links within the email and submit your credentials or respond to the scammer. You can report this activity to our team using the����or by forwarding it to��phishing@yorku.ca.

Red Flags to watch out for:

• Sender impersonation: The email may appear to come from “watchtower@eightninety.com” or similar addresses.
• Urgent language: Subject lines like “Watchtower Alert: Password Issue Detected” are used to provoke panic.
• Fake login page: Clicking the link directs users to a site mimicking 1Password’s interface, but hosted on a malicious domain.
• Subtle visual cues: The phishing page uses accurate branding and design elements, making it difficult to distinguish from the real site.
  

Additional Resources

• /uit/infosec/online-safety-tips/

The post Phish Alert - Beware of Sophisticated Phishing Campaign Targeting 1Password Users appeared first on Information Security.

October is Cybersecurity Awareness Month!

Throughout the month, the Information Security team will be sharing weekly cyber-focused themes, helpful resources, and interactive activities, all posted on our dedicated Cybersecurity Awareness Month page.

Be sure to check in each week for new content to keep you informed, engaged, and up to date on 91��ɫ’s latest cybersecurity initiatives.

The post Cybersecurity Awareness Month - October 2025 appeared first on Information Security.