In the emails, the attackers pose as managers or supervisors and ask for assistance with an "important task." The sender's name uses the name of the supervising person, but the emails originate from an external, mostly russian address. Currently, the subject "Are you on campus now?" is used. Names and email addresses of employees and supervisors are taken from the public websites of the University of Münster. If one responds to these contact attempts, the purchase of gift or prepaid cards is requested, followed by sending the codes via email.