The Cybersecurity and Infrastructure Security Agency (CISA) has warned of an email phishing scam that tricks users into clicking on malicious attachments that look like legitimate Department of Homeland Security (DHS) notifications. The email campaign uses a spoofed email address to appear like a National Cyber Awareness System (NCAS) alert and lure targeted recipients into downloading malware through a malicious attachment.
CISA encourages users and administrators to be wary of unsolicited emails, even if the sender appears to be known, and attempt to verify web addresses independently (e.g., contact your organization’s helpdesk or search the internet for the main website of the organization or topic mentioned in the email).
The agency also urges caution with email links and attachments without authenticating the sender.
Any suspicious emails should be Immediately reported to your information technology helpdesk, security office, or email provider.
