While the scam primarily targets personal banking accounts, it affects the broader post-secondary community, including students, parents, guardians, faculty, and staff. Fraudsters are exploiting trust in financial institutions and creating a false sense of urgency to pressure victims into approving transactions themselves. In several cases, banks refused to refund the money because the customer approved the charges during the call, even though they were tricked.

How the scam works:

1. You get a call that shows your bank’s real phone number on caller ID.
2. The caller says there is fraud on your account and asks you to open your banking app, or read back a code sent by text, to “stop” the charges.
3. You are actually approving payments to a school you have no connection to.
4. The criminals have already collected money from international students by offering them “discounted” tuition. Your card is used to pay that tuition.

Warning Signs:

• Requests to use your personal credit card or bank account to assist another person's tuition payment.
• An unexpected call claiming to be from your bank's fraud department.
• Pressure to act immediately to "stop" suspicious transactions.
• Requests to approve banking app notifications while on the phone.
• Requests to provide one-time passcodes or verification codes received by text or email.
• A caller who insists you remain on the line while reviewing your banking account.
• Offers to pay tuition on someone's behalf at a discount or through an unofficial arrangement.

Remember, Caller ID can be spoofed and should NOT be trusted as proof of identity.

If you think you've been targeted:

1. Contact your bank or credit card provider immediately.
2. Request that your cards be blocked or replaced if necessary.
3. Ask your financial institution to investigate the transactions and initiate any available dispute or chargeback process.
4. Report the incident to your local police service.
5. File a report with the Canadian Anti-Fraud Centre at .
6. Keep records of all communications, case numbers, statements, and correspondence.

Criminals no longer rely solely on stealing passwords. Increasingly, they manipulate victims into approving transactions themselves. Taking a moment to verify who you are speaking with and independently contacting your bank can prevent significant financial loss.

Stay vigilant and help raise awareness by sharing this information with family members, especially students and parents who may be involved in managing tuition payments.

Questions or Concerns?

Reach out to 91��ɫ's Information Security Team by emailing infosec@yorku.ca.

The post Growing Tuition Payment Scam Targets Canadians Through Fake Bank Fraud Calls appeared first on Information Security.

Despite conventional phishing techniques remaining effective, cyber criminals continue looking for new ways to compromise users' accounts. One lesser-understood method to do so is through device codes. Traditional authentication involves a username and a password; this can be extremely inconvenient or even impossible for devices lacking a keyboard or other way for users to input their credentials. Smart TVs and Internet-of-Things (IoT) devices are examples of "input-constrained" devices which may need to log into applications.

Device code authentication offloads authentication to a different device, such as a user's smartphone or computer. The "input-constrained" device's application generates a code for users to input on their alternative device and advise users to visit a legitimate link on the application developer's website (Microsoft, Netflix, etc.). Users will then go through their usual authentication process on a legitimate login page- username, password, 2-factor authentication. Afterwards, a token will be provided to the "input-constrained" device's app giving it access to the user's account.

However, a device using device code authentication does not actually need to be "input-constrained".

How does Device Code Phishing Work?

Consider the typical case of an attacker attempting to compromise a user's Microsoft 365 account:

1. An attacker visits a Microsoft application and initiates a device code authentication. They receive a device code. The attacker does not require a username or password to do this; the authentication is not against anyone in particular at this stage.
   
2. The attacker contacts their target via message, email, or phone call. Alternatively, codes can be generated when a user visits a malicious or compromised website under the guise of "verification". Their objective is to convince the user to visit the official Microsoft device code login page and enter the attacker's code.
   
3. The target enters the device code and then goes through their regular Microsoft authentication flow on the official Microsoft website, including 2-factor authentication if enabled.
   
4. Microsoft issues a token to the attacker's device granting access to the target's account.

Why is Device Code Phishing Effective?

There are several reasons why this technique is effective:

• Users are unlikely to understand what device code authentication is, or how it works.
  
• The attack occurs exclusively on legitimate domains/websites. A user suspicious of fake or look-a-like websites would only encounter trusted, official websites during the attack.
  
• Generative AI is capable of crafting convincing, personalized phishing messages to send users. AI can also address users' replies in an attempt to alleviate suspicion and provide additional, fake context around the device code request.
  
• Traditional login-related alerts may not work against device code phishing attacks due to authentication taking place on users' regular, trusted devices rather than the attacker's devices.

How can You Protect Yourself Against Device Code Phishing?

Many of the usual behaviours and defenses that protect against phishing and scams apply:

• Treat unsolicited messages asking you to enter a code with extreme suspicion. If you did not request a code, you should not be receiving one.
  
• Verify the identity of senders (email addresses, phone numbers). Consider the possibility that a trusted contact could have been compromised to send you phishing messages, or that a phone number was "spoofed" to appear as a trusted number.
  
• Carefully review warnings prior to clicking on links or entering codes; the Microsoft device code input page states that entering a code will grant account access to whoever generated it.
  
• Report suspicious messages to 91��ɫ IT, 91��ɫ's Information Security team, or trusted colleagues for a second opinion.

Questions?

91��ɫ's Information Security team can be reached at infosec@yorku.ca. Phishing emails can be reported to phishing@yorku.ca. General inquiries around IT can be directed to askit@yorku.ca.

References

• https://www.microsoft.com/en-us/security/blog/2026/04/06/ai-enabled-device-code-phishing-campaign-april-2026/?msockid=047ea62ec25164ad1aeeb0d0c38065a2
• https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/device-code-flow-the-gift-that-keeps-on-giving-%E2%80%94-to-attackers/4540949

The post Hacked WITHOUT Exposing Your Password? You NEED to Know about Device Code Phishing! appeared first on Information Security.

What is ClickFix?

ClickFix is a social engineering technique where attackers compromise legitimate websites and replace normal verification steps such as CAPTCHAs with fake prompts, and instruct users to run malicious commands on their computers. These commands often involve opening the Windows Run dialog or PowerShell and pasting in a script that appears to “fix” a problem or “verify” the user. In reality, the script is being used to download malware that compromises your device.

This technique has been observed across higher‑education institutions and is increasingly used to deploy malware families such as , a backdoor capable of downloading additional payloads, collecting system information, and maintaining persistence on the device.

How does it Work?

ClickFix attacks follow a simple pattern:

1. You click on a link from a search result or ad, and as the page loads, a strange-looking CAPTCHA or pop‑up appears unexpectedly.
   
2. Instead of asking you to click images or check a box, it tells you there’s a “problem” and you need to run a command to continue.
   
3. The page instructs you to open Windows + R, PowerShell, or Terminal and paste in a line of text.
   
4. That command silently downloads malware onto your device. In many cases, it installs a backdoor such as CORNFLAKE.V3, which can download additional malicious files onto your system, collect system information, and stay hidden on your machine.

Because the attacker convinces you to run the command, your device treats it as a trusted action, making it much harder for security tools to block.

How Can I Spot a ClickFix Attempt?

Exercise caution towards any unfamiliar website, email, or popup that:

• Asks you to open Windows Run (Windows + R)
• Tells you to paste a command into PowerShell or Terminal
• Claims you must run a script to “fix,” “verify,” or “continue”
• Appears immediately after clicking a search result or ad
• Displays a CAPTCHA that looks unusual, low‑quality, or out of place

If you encounter instructions like:

“Press Windows + R and paste the following command…”

…it is almost certainly malicious.

If you suspect you may have interacted with a ClickFix prompt, please report it to the Information Security Team immediately (infosec@yorku.ca).

References:

• https://unit42.paloaltonetworks.com/preventing-clickfix-attack-vector/
• https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/
• https://cloud.google.com/blog/topics/threat-intelligence/analyzing-cornflake-v3-backdoor/

The post Fake CAPTCHA, Real Threat: ClickFix Social Engineering Attacks appeared first on Information Security.

October is Cybersecurity Awareness Month!

Throughout the month, the Information Security team will be sharing weekly cyber-focused themes, helpful resources, and interactive activities, all posted on our dedicated Cybersecurity Awareness Month page.

Be sure to check in each week for new content to keep you informed, engaged, and up to date on 91��ɫ’s latest cybersecurity initiatives.

The post Cybersecurity Awareness Month - October 2025 appeared first on Information Security.

To access Duo SSDM, please visit  and login with your Passport 91��ɫ credentials. Once inside the portal, users will be able to add, remove and configure their authentication devices independently.

Benefits:
Users no longer need to reach out to IT staff for help with managing their devices. The new SSDM portal will equip users with the autonomy to manage their own authentication, improving the overall efficiency of Duo MFA.

What Devices and Duo Versions are compatible with the new SSDM?
Supported iOS and Android versions:
The current version of Duo Mobile supports iOS 15.0 or greater and Android 11 or greater.

Supported Browsers:
Duo Universal Prompt supports Chrome (Desktop and Mobile), Firefox, Safari (Desktop and Mobile) and Edge.

Note:
Not all browsers support all Duo authentication methods. Although we do not require users to download the Chrome browser, Duo recommends Chrome for the most seamless user experience and widest compatibility.

The supported browsers are listed below:
• Google Chrome
• Safari
• Firefox
• Microsoft Edge

For more information, please refer to the following  from Duo.

Please contact askit@yorku.ca if you have any questions or concerns.

The post Duo's Self-Service Device Management (SSDM) portal appeared first on Information Security.

As part of planned updates to 91��ɫ’s Duo 2FA service, the Duo login prompt will change to a refreshed and modernized look that is better optimized for desktop and mobile experiences - known as the Duo Universal Prompt. There are no functionality changes to Duo and the service will continue to be part of your Passport 91��ɫ and yuoffice/O365 logins as usual.

When will this occur: The new prompt will replace the current one on March 20, 2024.

Traditional Prompt:

New Duo Universal Prompt:

Note: The "Remember this device" option has changed from a checkbox to answering the "Is this your device" question:

Supported iOS and Android versions:

The current version of Duo Mobile supports iOS 13.0 or greater and Android 8 or greater.

Supported Browsers:

The Universal Prompt supports Chrome (Desktop and Mobile), Firefox, Safari (Desktop and Mobile), Edge, and Internet Explorer. Not all browsers support all Duo authentication methods, so for the widest compatibility we recommend Chrome.

The minimum supported version for all browsers are listed below:

• Google Chrome 38.0
• Safari 9
• Firefox 47.0
• Microsoft Edge 17
• Internet Explorer 11

What do I need to do?

If you enabled automatic app updates on your device, the Duo Mobile app will update automatically. Otherwise, you need to manually update the app on your device.

Additional Resources:

The post Upcoming Change to Duo 2FA Prompt appeared first on Information Security.

As of August 2^nd, UIT is making changes to the current “Report Phishing” button in Outlook. Users will see the existing button with the “fish” icon be replaced by a new version that is integrated with new Microsoft email protection technologies. The new button has a different icon but works similarly and provides more immediate reporting and response capability for suspicious messages. In addition to reporting the message to Information Security, messages will be automatically processed to improve filtering and help identify similar phishing attempts.

What is changing?

The look of the button is changing from:

to

Behind the scenes, the new button is connected to an entirely new mechanism for phishing reporting and response to improve effectiveness.

Note that there is no change to the phishing button for 91��ɫ’s Google G-suite email for students.

For more information please see the Report Phishing service page on the UIT Information Security website.

Behind the scenes, the new button is connected to an entirely new mechanism for phishing reporting and response to improve effectiveness.

Note that there is no change to the phishing button for 91��ɫ’s Google G-suite email for students.

For more information please see the Report Phishing service page on the UIT Information Security website.

The post Upcoming Changes to the Phish Reporter Button appeared first on Information Security.