Squirrel Mail Email Phishing Attempt

Fake Squirrel Mail Emails being sent to CMU addresses.

SCS Computing Facilities has received several questions concerning emails with the following headers:

Subject: We Advise All Users Of Squirrel Mail 1.4.11, and 1.4.12

To: upgrade

From: "Squirrel Mail Development Team"

These messages are not from the Squirrel Mail team. Please discard them and do not upgrade your client. We have received the following information from The Squirrel Mail site maintainers.

SECURITY: Spam Alert

Mar 05, 2008 by Paul Lesniewski

We would like to alert the community to the fact that, along with the long-standing spam issue detailed in our Administrator's Manual, there has been some spam circulating in the last several days that claims to be a package update notification from the SquirrelMail Team similar to the previous news item below. The message contains a link to a spoofed SquirrelMail login page that appears to harvest email addresses and passwords and then redirect back to squirrelmail.org. Please note that the SquirrelMail Team NEVER sends out direct, unsolicited messages, and will NEVER ask for your username, email address, or password. The only messages you'll ever get directly from the SquirrelMail Team are ones that come on one of our several mailing lists that require subscription.

If you have any questions regarding these Emails, please contact the SCS Help Desk at x8-4231 or send mail to help@cs.cmu.edu.

Thank you for your attention,

SCS Help Desk