¿ªÔÆÌåÓý

  1. GroupManagersForum
  2. Topics

One Drive hack/spam

 

Hi All,
Members of my group are reporting a malicious email, not sure whether to call it phishing or not. ?It purports to be one member of the group sharing a One Drive document with another member and asking the recipient to click on a link to see the document. ?The email is from one member to another using their email addresses. ?It doesn't go through groups.io.
Are other groups seeing this, or does it mean that my account has been hacked?
Thanks
Sally
?
 

On Mon, Sep 16, 2024 at 01:44 PM, Sally Ahnger wrote:
Members of my group are reporting a malicious email, not sure whether to call it phishing or not. ?It purports to be one member of the group sharing a One Drive document with another member and asking the recipient to click on a link to see the document. ?The email is from one member to another using their email addresses. ?It doesn't go through groups.io.
This is a classic phishing ploy.
?
The "bad guys" harvest email addresses of people who have some relationship to each other, and exploit that by sending a message to one of them purporting to be the other one. Usually, I see this in my non-profit organization, where I receive mysterious messages from the "President" asking me to contact him or send money somewhere. The spammer has obviously stolen our addresses from our web site (where I am listed as a board member).
?
It can also be done via phone call. We once had someone call claiming to be our grandson, who had just gotten into a wreck. My wife got all upset about this until I asked to be handed the phone and demanded that the caller provide his name.
?
"It's me, your grandson."
"Yes, but what is your NAME? You know your own name, don't you?"
[Wild guess...] "Mike Bowman?"
?
I hung up on him.

Are other groups seeing this, or does it mean that my account has been hacked?
A hacked account seems unlikely, especially if you're not the one who seems to be "sending/receiving" these messages. That said, there are steps you can take to inhibit spammers from harvesting email addresses:
?
1) Set "Member List Visibility" to owners only,
2) Make the group's message archive private, and/or
3) Turn on "mask email addresses in archive"
?
?
Hope this helps,
Bruce
 

Hi Sally

No I am not seeing that or having it reported by my subscribers

But rather than your account being hacked, it sounds like one of your subscribers email accounts has been compromised

Nivard Ovington in Cornwall (UK)

On 16/09/2024 18:42, Sally Ahnger via groups.io wrote:
Hi All,
Members of my group are reporting a malicious email, not sure whether to call it phishing or not. ?It purports to be one member of the group sharing a One Drive document with another member and asking the recipient to click on a link to see the document. ?The email is from one member to another using their email addresses. ?It doesn't go through groups.io.
Are other groups seeing this, or does it mean that my account has been hacked?
Thanks
Sally
 

On Mon, Sep 16, 2024 at 01:03 PM, Bruce Bowman wrote:
there are steps you can take to inhibit spammers from harvesting email addresses:
You can also make the group restricted, if it's not already, so that not just anyone can join and start collecting email addresses.
?
Duane
--
Lots of detailed information can be found in the Owners Manual and Members Manual.
 

¿ªÔÆÌåÓý

Sally shares:

?

¡°Hi All,

Members of my group are reporting a malicious email, not sure whether to call it phishing or not. ?It purports to be one member of the group sharing a One Drive document with another member and asking the recipient to click on a link to see the document. ?The email is from one member to another using their email addresses. ?It doesn't go through groups.io.

Are other groups seeing this, or does it mean that my account has been hacked?

Thanks

³§²¹±ô±ô²â¡±

?

More that likely that e-mails have been harvested ¡°somewhere¡±.?? Since the messages in question were sent from _one_ of your members to _other_ members of your group, but not _through_ the group there are several ways the e-mails could have been compromised.

?

  1. The member list could have been gleaned from your group¡¯s membership list on Groups.io.? As others have mentioned, this would depend on how accessible the group¡¯s membership and e-mails are on the list.? Others have already suggested ways to protect against this.
  2. More likely is the computer of the individual purported to be sending the messages has been compromised in one way or another, including .? If other group members are in his personal e-mail list on that computer, that would explain they are getting messages from ¡°him¡± directly, and not through the group.? If the group address is/was in that member¡¯s e-mail the list would most likely get a copy of that e-mail too.
  3. Under no circumstances should recipients of e-mails of this type click on those links unless they are expecting such an e-mail.? The link most likely contains a malware payload that will install itself on their computer for any number of nefarious reasons.? Anyone who received and opened such a link should scan their systems with approved protection software.? Various folks have different opinions on what works for them, but always keep your subscriptions to date, turn on automatic updates, and scan daily (usually in the wee small hours of the morning.

?

Best regards,

?

Steve

?

Steve Haas

Snoqualmie, WA
 

Thanks. ?I have Member List Visibility set to Members because people want to be able to see the list. ?But I have "mask email addresses in archive" set. ?And in visibility I have "group not listed in directory, private messages". ?Does that make the archive private? ?I can't find a setting to make the archive private.
?
I also have Restricted Membership, so people can't join without approval. ?So I don't think anyone has joined and then stolen email addresses.
?
Also, I did get one of the malicious emails and when I asked the person it was purportedly from, she said she had received the same message. ?So it's possible that one member's private email account was hacked and all the rest of the people who are getting these emails are in that person's contact list.
?
If this is not happening to other groups.io email lists then the problem is clearly not with groups.io.
?
Thanks,
SAlly
?
 

On Tue, Sep 17, 2024 at 02:53 AM, Sally Ahnger wrote:
I have Member List Visibility set to Members because people want to be able to see the list.
That's fine - if necessary - but you need to understand the risks involved. This is the main one.

But I have "mask email addresses in archive" set. ?
This helps, although they are masked for non-members anyway. Note that email addresses will still show up in outgoing group emails.

And in visibility I have "group not listed in directory, private messages". ?Does that make the archive private???
Yes, it does.

I also have Restricted Membership, so people can't join without approval. ?
That's good. Note that you cannot make the Member List available unless your group is Restricted.

So I don't think anyone has joined and then stolen email addresses.
I hope not, but realize that by sharing the Member List you've made it convenient for them do to so. Exercise due caution in vetting of new members and check existing members for anyone that looks suspicious.
?
As previously mentioned by others, it's also possible that one [or more] of your members has had their contacts list stolen. There's nothing you can do about that.
?
Good luck,
Bruce

1 - 7 of 7