More information about the attacks: The attacker is taking advantage of recipients to bypass Duke's multifactor authentication security protocols by trying to convince students, faculty, and staff to provide their credentials on a fraudulent web page, OR contacting the Duke user directly if they have provided their cell phone number and asking them to provide the Duo code. Unfortunately, some have provided the information, allowing the attacker to contact thousands more in the Duke system.
As a reminder, the best way to submit suspicious emails to IT Security is via the "Report Phish to Duke" button available in any Outlook client (PC, Mac, web, or mobile). We encourage students to also sign up for IT Alerts for updates in real time.
