The following email was a hoax, a so-called phishing email. The link led to a fake login page. Anyone who mistakenly clicked on the link would still have had the opportunity to recognise the hoax at that stage.

Please bear the following principles in mind when using email:

• Email is a potentially insecure means of communication and should therefore always be used with due caution.
• You should never click on a link or open an attachment without careful consideration.
• Always check the sender’s details carefully.
• Report any suspicious emails or those recognised as forgeries to User Services (nutzerservice@uni-weimar.de), particularly if no warning has yet been published on the SCC noticeboard, so that we can take appropriate action.

Empfehlung: Absolvieren Sie den Security Awareness Kurs (für Mitarbeitende verpflichtend!): Course: EN: Security awareness from secaware.nrw | Lernplattform Bauhaus-Universität Weimar

How to spot this phishing email:

• We do not use the sender name ‘Outlook Web’.
• The sender’s email address does not originate from Bauhaus University Weimar. PLEASE TAKE A CLOSE LOOK: instead of uni-weimar.de, umi-weimar.de has been used – a classic example of a so-called typo domain.
• The superfluous sentence intended to suggest security – “Message comes from Bauhaus University Weimar” – would not be used by us. You can tell where an email comes from by looking at the sender.
• Use of an outdated Outlook logo: This design was primarily used between 2013 and 2019 with Office 2013/2016/2019 and early versions of Microsoft 365. Newer versions feature a slightly modernised Outlook icon, in which the envelope and tile are designed slightly differently. We do not, as a rule, send HTML emails by default, nor do we embed logos or icons in our emails.
• We generally address users personally. Where impersonal forms of address are used, we employ either the gender-neutral form or both the masculine and feminine forms.
• Spelling mistakes, such as ‘lezter’ instead of ‘letzter’ here, are an indication of a forgery.
• The link (https://umi-weimar.de/app/UBACABTkFSGTjtCMQbdY6h) does not belong to the Bauhaus-Universität Weimar; PLEASE take a close look again: umi-weimar.de has been used instead of uni-weimar.de.
• The email lacks a closing salutation and the sender details customary at the Bauhaus-Universität Weimar.
• Our emails do not usually contain any details from software manufacturers.

Signs that the linked website is a fake:

• Anyone who mistakenly clicks on the link will see a warning pop up, at least in the MS Edge browser on centrally administered systems.
• Here, too, you should pay close attention to the link, which – as already noted in the email – does not originate from the Bauhaus-Universität Weimar.
• Outlook Web Access (OWA) at the Bauhaus-Universität Weimar has a completely different design. For example, the fake website lacks the logos of the Bauhaus-Universität Weimar and the HfM, the colour used is incorrect, and we do not use the envelope icon.
• Logging in to the Bauhaus-Universität Weimar’s OWA requires a username and password, not an email address and password as stated in the fake email.

-----Fake-Mail-----
Von: Outlook Web (noreply@umi-weimar.de)
Betreff: E-Mail-Versand fehlgeschlagen - Aktion erforderlich

Nachricht kommt von Bauhaus-Universität Weimar.

Sehr geehrter Nutzer,
Outlook konnte 3 Ihrer Nachrichten nicht an die Empfänger zustellen.
lezter Zustellungsversuch: vor einigen Minuten
Hier können Sie die Nachrichten überprüfen und zur Zustellung freigeben:
Nachrichten abrufen (https://umi-weimar.de/app/UBACABTkFSGTjtCMQbdY6h)

Microsoft respektiert Ihre Privatsphäre. Um mehr zu erfahren, lesen Sie bitte unsere Datenschutzerklärung. (https://privacy.microsoft.com/de-de/privacystatement)
Microsoft Corporation, One Microsoft Way, Redmond, WA 98052
 (https://umi-weimar.de/app/UBACABTkFSGTjtCMQbdY6h/email.gif)