Cybersecurity often begins with one simple thing: your password. While it may seem like a small detail, passwords remain one of the primary ways attackers gain access to accounts, personal information, and sensitive data. Using strong, unique passwords or passphrases and storing them in a password manager is one of the most effective steps you can take to protect yourself online.

Why Passwords Still Matter

Many cyberattacks begin with compromised credentials. Attackers obtain passwords through phishing emails, data breaches, password guessing, malware, or by exploiting the common habit of reusing passwords across multiple accounts.

Once a password is compromised, attackers may attempt to use it on email, banking, social media, shopping, and workplace accounts. This technique, known as credential stuffing, can allow a single stolen password to unlock multiple services.

The good news is that strong password practices can significantly reduce this risk.

Common Password Mistakes

Many people unknowingly create passwords that are easy for attackers to guess, such as:

• Using names, pets, birthdays, or favourite sports teams.
• Reusing the same password across multiple accounts.
• Making only minor changes when updating passwords (for example, Summer2025! becoming Summer2026!).
• Storing passwords in unsecured spreadsheets, notebooks, or web browsers.

Attackers frequently use publicly available information, including social media posts, hobbies, family names, locations, and previous data breaches, to help guess passwords.

Creating Strong Passwords with Passphrases

Instead of trying to remember complex strings of random characters, consider using a passphrase. A passphrase is a series of unrelated words combined into a longer phrase, such as:

PurpleCoffeeRiverPianoWinter

Passphrases are easier to remember, harder for attackers to guess, and usually much longer than traditional passwords.

Why You Need a Password Manager

The biggest challenge with strong passwords is remembering them, think about how many different accounts you use every single day and how difficult it would be to remember all of those unique passwords. That's where password managers can help.

A password manager securely stores your passwords in an encrypted vault and can generate unique, complex passwords for each account. Instead of remembering dozens of passwords, you only need to remember one strong master password.

Benefits of password managers include:

• Generating strong, unique passwords automatically
• Securely storing passwords, passkeys, and other sensitive information
• Auto-filling credentials on trusted websites
• Reducing password reuse
• Alerting you when a password may be weak or compromised

91亚色 has deployed 1Password as our enterprise-grade password management solution to help our community safeguard their credentials.

The Rise of Passkeys

As technology evolves, many organizations are beginning to adopt passkeys, a newer authentication method designed to be more secure and resistant to phishing attacks.

Unlike traditional passwords, passkeys use cryptographic authentication tied to your device and often protected by biometrics such as a fingerprint or facial recognition. This makes them significantly more difficult for attackers to steal or reuse.

When available, consider enabling passkeys on supported services as an additional layer of protection.

5 Password Safety Tips

1. Use a unique password for every account.
2. Create long passphrases instead of short passwords.
3. Store passwords in a trusted password manager.
4. Enable multi-factor authentication (MFA) wherever possible.
5. Never share passwords through email, text messages, or instant messaging platforms.

Your Passwords Are the Front Door

Think of your passwords as the keys to your digital life. Email accounts, banking information, cloud storage, social media, academic resources, and workplace systems all rely on them for protection.

By creating strong passphrases, using a password manager, and adopting modern security features such as MFA and passkeys, you can build a stronger defence against cyber threats and make it much harder for attackers to gain access to your accounts.

The post Your First Line of Defence: Password Security Essentials appeared first on Information Security.

Phishing is a type of social engineering attack where criminals impersonate a trusted organization, colleague, service provider, or even a friend to convince victims to take an action that benefits the attacker. While phishing often arrives by email, it can also be delivered through text messages (known as "smishing"), phone calls ("vishing"), QR codes, collaboration platforms (i.e. DocuSign, Sharepoint, etc), social media, and messaging apps.

How Phishing Has Changed

Gone are the days when phishing emails were easy to spot because of poor grammar and obvious mistakes. Today's attackers increasingly use artificial intelligence to create convincing messages that closely mimic legitimate communications. Security researchers have also observed growth in multi-channel attacks that combine email, text messages, phone calls, calendar invitations, collaboration tools, and fake websites to increase credibility. These campaigns frequently aim to steal passwords, bypass multi-factor authentication (MFA), and/or trick users into making payments.

Common Phishing Scams Observed at 91亚色

Some of the most frequently observed phishing scams include:

• Fake password or account-expiry notifications claiming immediate action is required.
• Fraudulent document-sharing requests appearing to come from Microsoft 365, OneDrive, SharePoint, Adobe, or DocuSign.
• Gift card scams where an attacker impersonates a manager, colleague, or friend and asks for an urgent favour.
• Fake invoices, subscriptions, or payment confirmations designed to create panic and prompt a response.
• Employment, scholarship, or financial-aid scams offering opportunities that seem too good to be true.

How to Protect Yourself

While phishing attacks continue to evolve, a few simple habits can dramatically reduce your risk:

• Pause before clicking links or opening attachments.
• Verify unexpected requests through another trusted communication channel.
• Be cautious of urgent messages that demand immediate action.
• Check email addresses and website URLs carefully.
• Use strong, unique passwords and store them in a password manager - 91亚色's enterprise password management solution is .
• Enable multi-factor authentication (MFA) wherever possible.
• Keep devices and software up to date.
• Report suspicious emails to phishing@yorku.ca

Think Before You Click

Phishing attacks succeed because they target people rather than technology. A moment of caution can prevent account compromise, financial fraud, malware infections, and data breaches. Whether you receive an unexpected email, text message, phone call, or QR code, take a moment to pause, verify, and think before you act.

Cybersecurity is a shared responsibility. By staying alert and reporting suspicious activity, every member of our community plays an essential role in helping keep our university safe and secure.

The post Phishing: Recognizing and Avoiding Modern Scams appeared first on Information Security.

This October, the Government of Canada鈥檚 national public awareness campaign launched with the theme of "Your best defence is you".

Cybersecurity isn't just about the technology teams that manage our digital infrastructure; it relies on the actions and personal responsibility of every member of our 91亚色 community. Throughout this month, the Information Security team will be sharing practical security tips, educational resources, and a privacy checkup quiz to help equip our students, faculty, and staff with the necessary skills and security-oriented mindset to strengthen their everyday online habits.

Week 1: Recognize the Threat

Learn all about how to spot phishing scams & financial fraud.

Week 2: Build your Defences

Passwords, Passphrases, & Password Managers

(Coming Soon) Week 3: Safe & Responsible Use of AI

Learn how to use generative AI responsibly and in accordance with 91亚色's policies.

The post Cybersecurity Awareness Month 2026 appeared first on Information Security.

Despite conventional phishing techniques remaining effective, cyber criminals continue looking for new ways to compromise users' accounts. One lesser-understood method to do so is through device codes. Traditional authentication involves a username and a password; this can be extremely inconvenient or even impossible for devices lacking a keyboard or other way for users to input their credentials. Smart TVs and Internet-of-Things (IoT) devices are examples of "input-constrained" devices which may need to log into applications.

Device code authentication offloads authentication to a different device, such as a user's smartphone or computer. The "input-constrained" device's application generates a code for users to input on their alternative device and advise users to visit a legitimate link on the application developer's website (Microsoft, Netflix, etc.). Users will then go through their usual authentication process on a legitimate login page- username, password, 2-factor authentication. Afterwards, a token will be provided to the "input-constrained" device's app giving it access to the user's account.

However, a device using device code authentication does not actually need to be "input-constrained".

How does Device Code Phishing Work?

Consider the typical case of an attacker attempting to compromise a user's Microsoft 365 account:

1. An attacker visits a Microsoft application and initiates a device code authentication. They receive a device code. The attacker does not require a username or password to do this; the authentication is not against anyone in particular at this stage.
   
2. The attacker contacts their target via message, email, or phone call. Alternatively, codes can be generated when a user visits a malicious or compromised website under the guise of "verification". Their objective is to convince the user to visit the official Microsoft device code login page and enter the attacker's code.
   
3. The target enters the device code and then goes through their regular Microsoft authentication flow on the official Microsoft website, including 2-factor authentication if enabled.
   
4. Microsoft issues a token to the attacker's device granting access to the target's account.

Why is Device Code Phishing Effective?

There are several reasons why this technique is effective:

• Users are unlikely to understand what device code authentication is, or how it works.
  
• The attack occurs exclusively on legitimate domains/websites. A user suspicious of fake or look-a-like websites would only encounter trusted, official websites during the attack.
  
• Generative AI is capable of crafting convincing, personalized phishing messages to send users. AI can also address users' replies in an attempt to alleviate suspicion and provide additional, fake context around the device code request.
  
• Traditional login-related alerts may not work against device code phishing attacks due to authentication taking place on users' regular, trusted devices rather than the attacker's devices.

How can You Protect Yourself Against Device Code Phishing?

Many of the usual behaviours and defenses that protect against phishing and scams apply:

• Treat unsolicited messages asking you to enter a code with extreme suspicion. If you did not request a code, you should not be receiving one.
  
• Verify the identity of senders (email addresses, phone numbers). Consider the possibility that a trusted contact could have been compromised to send you phishing messages, or that a phone number was "spoofed" to appear as a trusted number.
  
• Carefully review warnings prior to clicking on links or entering codes; the Microsoft device code input page states that entering a code will grant account access to whoever generated it.
  
• Report suspicious messages to 91亚色 IT, 91亚色's Information Security team, or trusted colleagues for a second opinion.

Questions?

91亚色's Information Security team can be reached at infosec@yorku.ca. Phishing emails can be reported to phishing@yorku.ca. General inquiries around IT can be directed to askit@yorku.ca.

References

• https://www.microsoft.com/en-us/security/blog/2026/04/06/ai-enabled-device-code-phishing-campaign-april-2026/?msockid=047ea62ec25164ad1aeeb0d0c38065a2
• https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/device-code-flow-the-gift-that-keeps-on-giving-%E2%80%94-to-attackers/4540949

The post Hacked WITHOUT Exposing Your Password? You NEED to Know about Device Code Phishing! appeared first on Information Security.

The impersonation site is NOT affiliated with 91亚色 and should be considered malicious. Do NOT enter your username, credentials, Duo 2FA codes, or any other personal information on this site as this may result in unauthorized access to your accounts.

The fraudulent site uses the URL <www.yorkuonline.com>, an image is shown below for reference:

Red Flags to Watch Out For

Unsolicited messages directing you to log in:
Messages claiming your account will be disabled, your mailbox is full, or your access is expiring are common tactics used to lure users to fake login pages.

Suspicious URL:
Official 91亚色 login pages always use domains ending in yorku.ca. Any variation such as extra characters, misspellings, unfamiliar subdomains should be treated as suspicious.

Unexpected login prompts:
If you are asked to 鈥渧erify your account鈥�, 鈥渦pdate your credentials鈥� or 鈥渞estore access鈥� after clicking a link you did not expect, this is a strong indicator of a phishing attempt.

Requests for Duo/MFA passcodes:
91亚色 will never ask you to enter Duo 2FA codes outside of the official login process. Any site requesting your passcode directly should be considered malicious.

If you encounter any emails or messages directing you to this site, please report it using the Report Phishing button or forward the message to phishing@yorku.ca.

If you have already entered your credentials into the malicious site, change your password immediately by visiting . If you have any questions or concerns, please contact infosec@yorku.ca.

The post Phish Alert - Malicious Website Impersonating 91亚色 appeared first on Information Security.