There is a very real and urgent internet based threat targeting McMaster University.  A malicious actor is using URLs that closely resemble “mcmaster.ca” websites to exploit members of the McMaster community who accidentally mistype the URL of the site they want to visit.  Here is an example of a fraudulent URL, please note the misspelled “mcamster”:

• www[dot]mcamster[dot]ca

IT Security is warning everyone against visiting the fraudulent websites.

The malicious URLs redirect unsuspecting people to Internet Fraud websites. The websites use common social engineering tactics to induce users to call 1-800 help desk phone numbers. The agents receiving calls at the 1-800 numbers then convince the callers to install malicious software. All URLs in the fraudulent domain carry similar messaging.

The threat does not appear to be directly exploiting computers, but malware could still end up on your system from accidentally visiting one of these sites.

IT Security is advising everyone to do the following:

1. Please be very careful when manually entering URL addresses in to your browser.
2. Please be very careful about the websites you visit and the links you click in emails and also the attachments they are opening.
3. Please make sure that your computer operating system is updated and patched. We recommend that everyone configure their operating systems to automatic check for important updates.
4. Please make sure that you are using the latest versions of critical applications such as Adobe Flash and Reader, Java or your favourite browser. The vendors of these applications often release critical security updates, and it is very important to install these.
5. Please make sure that your anti-virus is up-to-date, and run a scan if you believe that you have become infected with malware.

IT Security expects to see the fraudulent domains appear in Phishing emails sent to recipients in the McMaster community.   If you receive a suspicious email, be sure to report is to the service desk by forwarding it as an attachment to uts@mcmaster.ca or using the “Report Suspicious Email” service form on IPACS (https://ipacs.mcmaster.ca/)