Warning about current scam e-mails

An increased number of different scam emails are currently being sent to many members of the University of Münster.

Several different campaigns have been observed in which the attackers pose as university employees, supervisors, or conference organizers. In these emails, items are offered as gifts, recipients are asked to purchase gift cards or prepaid cards, or alleged bookings for conference attendance are confirmed. All of these are fraud attempts aimed at getting recipients to make payments through various channels.

Warning about current phishing e-mails

An increased number of phishing emails are currently being sent to members of the University of Münster. 

These  e-mails impersonate the IT department and have the subject "Schulnachrichten für Jul: Wir senden Ihnen diese Benachrichtigung, um Sie darüber zu informieren, dass Sie für unser neues Lohnabrechnungsprogramm für Juli qualifiziert sind.". They claim that a new payroll software is available and that recipients need to verify themselves using their login credentials. This is just a pretext to lure recipients to an external website controlled by the attackers, which collects the entered login credentials.

Warning about current scam e-mails

An increased number of scam emails are currently being sent to many members of the University of Münster.

These emails with the German subject "Spende eines Yamaha Baby-Flügels für ein liebevolles Zuhause.!!!" pretend to be sent by employees of the University of Münster and claim that a piano is to be given away. However, this is actually the beginning of a scam attempt. The criminals try to convince victims to transfer alleged transportation costs without a prior inspection having taken place. The piano itself does not exist and is not shipped by the criminals.

Warning about attacks with fake captchas (ClickFix)

Currently, there's an increasing number of so-called ClickFix attacks (also known as Fake-Captcha attacks) being observed against members of the University of Münster. This attack method lures users to manipulated websites that display seemingly harmless Captcha prompts, error messages, or verification requests (e.g., "I am not a robot," "Please verify you are human," or "To fix the problem, please follow these steps"). Entry often occurs via manipulated search results, compromised websites, phishing emails, or advertisements. Instead of a genuine Captcha check, users are instructed to perform a dangerous action or key combination.

Anyone who executes these steps unknowingly starts malware on their device or unwittingly grants attackers access to services. Attackers use this to steal login credentials, session cookies, or other sensitive information, or to permanently compromise the system. Often, stolen credentials are then used for further attacks. Similar variants exist for macOS and Linux, prompting users to execute commands in the terminal.

Warning about attacks using messaging services

The media have recently reported repeatedly on phishing attacks carried out via the messaging services WhatsApp and Signal.
If you have forwarded security codes in the messenger or scanned a QR code, you may be affected. The German domestic intelligence services provides detailed information, particularly on how to detect a potential compromise, at https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/praevention_wirtschafts-und_wissenschaftsschutz/2026-04-27-phishing-via-messenger-services.html
This is not a compromise of the Signal messenger itself. Signal therefore continues to be classified as secure (for private use).

In this context, the Ministry of the Interior of North Rhine-Westphalia also warns against using the Russian messaging service MAX. This app provides Russian security authorities with maximum access to digital devices. If you install the MAX app on your own device, you must therefore expect all stored information to be passed on to the Russian security authorities. You should therefore not install this app on devices on which you process work-related data.

Warning about Current Scam E-mails

Several attempts of targeted scam via e-mail have been observed over the past few weeks. In those cases directors of different departments have been impersonated to send out e-mails with requests for assistance ("Are you available?").

Microsoft Outlook for macOS transfers data to the cloud

When setting up IMAP accounts with Microsoft Outlook for macOS with the option "Synchronize with Microsoft Cloud" enabled by default, passwords and e-mail content are forwarded to the Microsoft Cloud (see Heise). This means that sensitive data is no longer confidential, but is transmitted to Microsoft.

Note on unauthorized e-mail apps

A number of apps and programs are not permitted to retrieve emails from the University Münster mailboxes (both via Exchange and IMAP or POP).

The list currently includes the following applications:

  • Outlook-App for Android and iOS
  • Outlook for MacOS (when using IMAP with CloudSync)
  • The "new Outlook" or "Outlook (new)" (the Outlook version pre-installed under Windows 11)
  • Edison Mail
  • Newton Mail
  • Spark Mail
  • BlueMail
  • Xiaomi Mail/MiMail
  • Canary Mail
  • myMail
  • Mail.ru
Email apps that use (cloud-based) AI functions to read and analyse emails are also prohibited.

Click here for the full note

Warning about Current Extortion E-mails

Lately a rising amount of extortion attempts with spam e-mails has been sent to members of the University. The originators usually claim to have "hacked" into a person's computer or e-mail account and threaten to publish sensitive information, if their demands are not met. Often a payment of in a crypto currency like Bitcoin is requested. All those claims are mere pretences to urge the receiving personmto give into their demands.

Warning about the software update for the new Outlook version in 2024

The new Outlook version will replace the pre-installed e-mail program in Windows in 2024, and later also the classic Outlook from the Office package. The new version synchronizes data with the Microsoft Cloud when using IMAP or POP (Exchange is not affected), which means that e-mail content and passwords are transmitted to Microsoft.