Malicious file share messages and fake event invitations are a recurring trend. Be cautious when you receive messages like this and report anything that looks odd to you - These incidents can snowball and put other members of the MHC community at risk.
For example, recently an MHC student received an email that they thought was from their former professor. Engaging with the message led to the student's MHC Account being compromised and ultimately used to send out a new round of phishing emails that led to additional students' accounts being compromised. More details below about how these incidents can spread and impact other community members.
Important takeaways
- If you get an email you didn't expect that is asking you to click a link or open an attachment, stop. Contact the alleged sender via a different method (e.g. don't just reply to the email) and verify the message's legitimacy first before engaging.
- LITS also encourages you to report the message as phishing directly within Gmail to have it re-reviewed by our anti-phishing security software.
Timeline of events
- Some point on or before October 20th: The former professor's personal email account was compromised.
- October 20th: The former professor's compromised personal email was used to send out a phishing message with the subject line "Protected Message from [Professor name] – Please Read".
- Immediately: A current MHC student opened the email, clicked on the link in it, and provided their password before the message was removed from their inbox by MHC's anti-phishing security software.
- Several hours later: The former professor sent a follow up message to the student warning them that their personal email had been hacked and to delete the message they'd received.
- Several weeks passed, during which the attackers bided their time while having already compromised the student's account. This is a common strategy to make it harder to track down the series of events that led to the compromise.
- November 4th: The attackers used the student's compromised MHC email to send out a new phishing message to a large group of MHC and non-MHC recipients with the subject line "SAVE THE DATE! YOU ARE INVITED". Because this message came from a legitimate MHC email address, people were more likely to think it was a safe message and get tricked into engaging with it.
- Immediately afterwards: Several MHC students clicked on the link in that message and entered their credentials, compromising their accounts, all in the moments before the message was removed from their inbox by MHC's anti-phishing security software.
- November 4th-5th: LITS helped the students secure their MHC Accounts and removed the messages from all MHC inboxes.
Message Details
The initial message from the former professor's compromised personal email address
Subject line: Protected Message from [name] – Please Read
Date sent: Oct 20, 2026, 4:23 PM EDT
From: personal email of a former professor
Content:
[former professor’s name and email address]
has sent you a protected message.
Read the message [Malicious link removed]
Learn about messages protected by Microsoft Purview Message Encryption.
Privacy Statement
Learn More on email encryption.
Microsoft Corporation, One Microsoft Way, Redmond, WA 98052
The phishing message sent out by the student's compromised MHC Account
Subject line: SAVE THE DATE! YOU ARE INVITED
Date sent: Nov 4, 2026, 10:55 AM EST
From: compromised student email address
Content:
You are cordially invited
VIEW THE CARD [Malicious link removed]
[Student's name removed]
Saturday, Nov 7th
05:00 PM
View guest list
