From: National Bank Direct Brokerage <[name-redacted]@canadawest[.]cc>

To: [Internal Employee]

Registered Retirement Savings Plan

Your RRSP contribution summary is attached, including total contributions and employer matching summary.

Final 2025 contribution deadline is September 1st 2026 for maximum tax benefit.

This document requires Adobe Acrobat Reader.
Download Adobe Reader

Vancouver Island university • BMO Pensions

This is an automated notification, Please do not reply directly to this email.

• The message comes from a compromised external account ([name-redacted]@canadawest[.]cc) and displays VIU's External Email warning banner. Genuine messages about employee benefits come directly from internal VIU email addresses.

• The sender displays National Bank Direct Brokerage, the email footer lists BMO Pensions, and the document claims to come from Vancouver Island University Retirement Services. Authentic university pension communications never mix competing banks.

• The attached PDF (Vancouver island university RRSP-September-520139.pdf) is locked with a password (mULW9r8968H2). Attackers encrypt files so email security tools cannot scan the document or check the web link inside.

• The document asks you to select VIEW RRSP SUMMARY. This button directs you to an external website (red-flower-047159610.5.azurestaticapps[.]net) designed to steal your university login credentials.

• The email and PDF contain multiple obvious errors. These include lowercase school branding ("Vancouver island university"), spelling mistakes ("REGISERED RETIREMENT SAVINGS PLAN") and false Canadian tax deadlines ("September 1st 2026").

From: Dell | Order Received <received[@]order.dell[.]com>

To: abubakarsadiqmuhamma771[@]gmail[.]com

Hello Order,

We have your order that you placed on September 16, 2026. Your Dell purchase ID is 2009835261727. Next, you should receive an order confirmation.

To manage your orders, you'll need to create a My Account using the same email as this purchase.

Do more online while you wait for your order.

My Account: Review order history, change your shipping address, start a return or exchange, get help or cancel your order.

Review frequently asked questions: Quickly find answers to common support questions.

Thank you for choosing Dell Technologies.

• The scammers put a fake phone number (802 547 4437 / (802) 5474437) directly inside the Ship To and Bill To address lines. They label it "Helpline" and "Call Our Sales Team" so you will call them to dispute the $736.09 charge.

• The message is sent to an outside Gmail account (abubakarsadiqmuhamma771[@]gmail[.]com) instead of your VIU email address. Scammers often send these emails to large lists or blind copy (BCC) groups.

• The message comes from a genuine Dell address (received[@]order.dell[.]com). The attackers submit orders through the real Dell website with fake address lines so the email passes spam filters.

• The message starts with "Hello Order" because the scammer typed the word "Order" as the customer first name. The high total ($736.09) is meant to shock you into calling without thinking.

From: Vancouver Island University MBA Program SecureStreamer · Enterprise ShareFile <no-reply[@]viu[.]ca>

To: [Targeted Department]

Vancouver Island University MBA Program Mail

Hi [Targeted Department],

A secure company support package has been made available for [Targeted Department].

Authorize Support

Please use the link above only on your authorized work computer.

Regards,
Viu Mail

• The sender claims to be the VIU MBA Program and displays no-reply[@]viu[.]ca. However, the External Email banner and [External] tag confirm the email originated outside VIU servers. Authentic internal messages from VIU departments do not carry external warning banners.

• The subject line refers to a "Non Disclosure Agreement," while the message body claims to share a "company support package" with an Authorize Support button. Attackers often combine mismatched templates from different scam kits.

• Instructs you to use the link "only on your authorized work computer." Attackers use this psychological tactic to mimic legitimate workplace IT compliance rules and build false trust.

• The email targets a departmental inbox with a generic greeting ("Hi Advising,") and signs off as "Viu Mail" with improper capitalization. Official VIU communications follow consistent naming and branding standards.

From: JOB FOR YOU! <b62753139[@]gmail[.]com>

To: [Internal Employee]

WAITING FOR YOUR RESPONSE?

On Thu, Aug 27, 2026 at 7:43 AM JOB FOR YOU! <b62753139[@]gmail[.]com> wrote:

[First Name]

What's the best mobile or work number to reach you via text?

Warm regards.

• References VIU President Dennis Johnson in the subject line, but was sent from a random external Gmail account (b62753139[@]gmail[.]com) with a mismatched display name ("JOB FOR YOU!").

• Displays VIU's External Email warning banner. Genuine communications from VIU leadership originate internally from @viu.ca addresses.

• Asks for your personal mobile number to move the conversation to text messaging, a common tactic used to bypass email security and initiate gift card fraud.

• Uses all-caps follow-up messaging ("WAITING FOR YOUR RESPONSE?") and fake reply threading ("Re:") to create artificial urgency and pressure you into a quick reply.

From: [Name Redacted] <[name-redacted]@islandoverheaddoors[.]com>

To: [Internal Employee]

Hello,

Our partners invite qualified contractors and vendors to submit bids for the New Commercial Development - Buildings A, B & C.

Project Size:
• Building A: 450,862.43 sq. ft.
• Building B: 450,862.43 sq. ft.
• Building C: 1,200,300.89 sq. ft.

The project includes a multi-purpose arena, conference centre, office and residential towers, retail and entertainment spaces, parking facilities, and related site infrastructure.

Updated drawings, specifications, and addenda are available through:
Island Overhead Doors - New Commercial Development - Project Documents

Scope includes: demolition, concrete work, metal fabrication, carpentry, millwork, firestopping, doors and hardware, drywall, ceilings, flooring, tile, painting, washroom accessories, and related electrical/mechanical work.

Please submit your proposal in accordance with the ITB, including all assumptions, exclusions, qualifications, and alternates.

Submission Deadline: Friday, September 18, 2026, at 5:00 PM.

Thank you for your interest. We look forward to receiving your proposal.

--
Thank You,
[Name Redacted]
Island Overhead Doors (1979) Ltd.

• Sent from a compromised business account ([name-redacted]@islandoverheaddoors[.]com). This helps the message get past spam filters.

• Asks you to submit bids for a major construction project without any prior contact or business history.

• The document link leads to vistaipa[.]com. This page mimics project software to steal your login credentials.

From: SharePoint Online <no-reply@sharepointonline[.]com>

To: [Internal Employees]

Cc: [Name Redacted] <[name-redacted]@somaiya[.]edu>

• Shows VIU's External Email warning banner. This warns you that the message came from outside VIU, even though it claims to be from the President's office.

• Sent through a compromised account at somaiya[.]edu, an external school domain, to get past spam filters.

• Claims to come from VIU President Dennis Johnson to create false authority and rush you into opening the file.

• Displays SharePoint Online and references an outside user in the subject line, but claims to share an internal document.

• Uses a generic file name (Documentations Review1) with a OneNote link and no helpful details.

From: [Internal Instructor]

To: [Internal Students and Staff]

Date: Sunday, August 2, 2026 9:44:23 PM

Dear Students and staffs,

As the academic session About to resumes, we continue to explore practical ways to support learning, research, and creative work among staffs and students.

We would like to inform you of an educational support initiative made available through Mrs. Kristian, who is in the process of downsizing personal equipment previously owned by her late husband. In keeping with her long-standing support for education, she has chosen to make several items available to students/staffs for academic and educational use.

The purpose of this initiative is to ensure that functional learning tools are put to continued use in coursework, research, creative projects, and other approved academic activities.

The available items include:

• A gorgeous violin (swoon!)
• A 2014 Yamaha baby grand piano (imagine the melodies!)
• The iconic Eric Clapton signature 1939 Martin OOO-42 guitar (OMG!)
• A Leica S (Typ 007) digital SLR camera (for all the memories!)
• A PlayStation 5 (game on!)
• An Xbox Series X – 2TB Galaxy Special Edition (level up!)
• A 2023 14-inch MacBook Pro (work and play!)
• An 11-inch 2023 iPad Pro (so sleek!)
• A 2023 Apple Vision Pro (the future is here!)

Distribution will be handled on a fair and need-based basis....Students and staffs who wish to make an inquiry will take care of the delivery fee , information and contact Mrs. Kristian directly at her email only- Kristianaking20590[@]gmail[.]com, or phone text +1(804)670-6900 and her only iMessage contact rice20590[@]gmail[.]com. you can reach out to her on any of the listed contact options.

Thank you for your attention

• Sent from a real VIU account that was compromised. Attackers use this to bypass spam filters.

• Offers free high-value items, but asks you to pay a delivery fee. The scammer keeps your money and sends nothing.

• Lists expensive items like a grand piano and Vision Pro with strange hype words like "(swoon!)" and "(game on!)".

• Tells you to write to external Gmail addresses (Kristianaking20590[@]gmail[.]com) or text a phone number instead of using VIU email.

• Has no subject line and contains grammar mistakes such as "session About to resumes" and "delivery fee , information".

From: [Name Redacted] <[name-redacted]@uwinnipeg[.]ca>

To: [Name Redacted] <[name-redacted]@uwinnipeg[.]ca>

• Sent from a compromised email account at another school ([name-redacted]@uwinnipeg[.]ca) to slip past spam filters.

• Asks you to select View Details. This starts a device code login trick to steal your account and bypass 2-Step Verification.

• Displays VIU's External Email warning banner and a first-time sender alert, showing the email came from outside.

• Uses generic phrases like "Your complete document is ready" without explaining what the file is or who requested it.

• Copies the University of Winnipeg logo and copyright text to make the fake email look official.

From: [Name Redacted] <[name-redacted]@burnabynh[.]ca>

To: [Name Redacted] <[name-redacted]@burnabynh[.]ca>

• Sent from a real non-profit account ([name-redacted]@burnabynh[.]ca) that was compromised to bypass email filters.

• Hovering over the link shows an outside website (ggproducts[.]in) that has no link to the non-profit or VIU.

• Shows the External Email banner and first-time sender alert, indicating an unverified outside message.

• Uses "Click Here" to hide the suspicious web link. Always hover over links to check where they go before clicking.

• Uses generic phrases like "sent you a secure email" with strange punctuation ("Burnaby Neighbourhood House.").

From: SharePoint Online <no-reply@sharepointonline[.]com>

Cc: KIT CLARK NOB <kitclark[.]nob[at]mu[.]edu[.]ph>

Reply to: kitclark[.]nob[at]mu[.]edu[.]ph

This email is generated through Misamis University's use of Microsoft 365 and may contain content that is controlled by Misamis University.

• Displays an External Email warning banner. Real VIU policy messages are sent internally and do not show this banner.

• The Reply-To and Cc lines show an outside school domain (mu[.]edu[.]ph) instead of a @viu.ca address.

• Attackers use compromised accounts from other organizations so their fake notices pass spam filters.

• Uses an urgent subject line ("Updated Employment Policies and Required Review") to rush you into opening the link without checking the sender.

From: Dennis Johnson <noreply[at]lobbes[.]nl>

To: [Internal Employee]

Reply to: dennis[at]msgtel[.]com

Please ensure payment is made today.

Thank you,
Dennis Johnson

• Displays the name of VIU President Dennis Johnson, but the sender address is a Dutch domain (noreply[@]lobbes[.]nl) and replies go to dennis[@]msgtel[.]com.

• Demands immediate payment ("Please ensure payment is made today") for a large sum ($76,024.24) by wire transfer.

• Includes fake email history to make it look like university leadership already approved the invoice.

• Includes an attached PDF (invoice_[Internal Employee].pdf) named with the recipient's name to trick them into opening it.

• Shows VIU's External Email warning banner, confirming the message came from outside VIU.

From: Adam Smith <customercare[at]netgeeks[.]net>

To: [Internal Employee]

Reply to: Adam[.]Smith[at]whitingturner-group[.]com

Dear Team,

I hope you are doing well.

We are currently identifying subcontractors for an upcoming construction project and would like to confirm the appropriate contact for RFP or prequalification inquiries.

If you are the correct point of contact, we would be pleased to provide additional project information and discuss potential participation. If not, we would appreciate it if you could direct us to the appropriate individual or department.

Thank you for your time and assistance. We look forward to your response.

Best regards,

• Sent from customercare[@]netgeeks[.]net, but replies and the signature point to [name-redacted][@]whitingturner-group[.]com.

• The real company site is whiting-turner[.]com, but the email uses a fake domain (whitingturner-group[.]com).

• Uses a polite business question to see if your inbox is active and collect staff names before sending more dangerous scams.

• Adds random characters (90_Eq_90_AhQ) to the subject line to trick spam filters.

• Uses a generic greeting ("Dear Team,") instead of addressing you by name.

From: notice[at]priority[.]notification[.]mail via SurveyMonkey <member@surveymonkeyuser.com>

To: [Internal Employee]

Reply to: notice[at]priority[.]notification[.]mail

Dear [Internal Employee],

We've uncovered a critical firmware conflict that's blocking your device from receiving essential security enhancements. Your hardware remains secure at this moment, but continued access is not guaranteed unless you take action.

This isn't a routine suggestion—it's a required manual intervention to restore full functionality and protect your assets from potential disruption.

Update Now

Thank you for acting quickly to keep your device secure and fully operational.

⚪ Sincerely,

• Sent using SurveyMonkey (member[@]surveymonkeyuser[.]com) to slip past spam filters. IT Services never sends hardware warnings through survey tools.

• The footer says "Please do not forward this email as its survey link is unique to you", proving this is a survey form rather than an IT alert.

• Uses a fake sender name (notice[@]priority[.]notification[.]mail) to pretend to be an official automated IT system.

• Uses alarming terms like "critical firmware conflict" to cause panic and rush you into clicking.

• Shows VIU's External Email warning banner. Real IT maintenance notices come from internal @viu.ca addresses.

From: Canada Revenue Agency (MyCRA) <ventas[at]aimeos[.]masiva[.]red>

To: [Internal Student]

Reply to: Canada Revenue Agency (MyCRA)

English version *** La version française suit ***

There is unread mail with an updated 2025 T4 from the Canada Revenue Agency (CRA) dated June 04, 2026, in your My Account, that requires your attention.

Click Here to view "Mail/PDF Attached" to read your mail.

If you do not have My Account, go to the CRA website to register.

This is an automated email message UW5UWR7K. Please do not reply.

Version française *** The English version precedes ***

• Claims to come from the Canada Revenue Agency about a T4 tax slip. The CRA never emails direct links to access tax records.

• Sent from an outside domain (attacker[@]tax-notice-portal[.]com) that has no link to the Canadian government.

• The link directs you to an external website designed to steal your CRA or banking credentials.

• Displays VIU's External Email warning banner, confirming the message was sent from outside the university.