InTheKnow

Keeping You Updated On The Latest Confirmed Phishing Emails & Techniques 

**If you have opted into our monthly Managed Service subscription, we have already taken proactive measures to block or prevent known risks for you!  

4/2/25: Wells Fargo Support - Google Drive share

Key Points: A) Will come from WеIIsFаrgо© - Suppоrt ... (via Google Drive) <drive-shares-noreply@google.com as the subject Item shared with you: "ОnIinе Vеrifiсаtion Nееdеd - Rеnеw Nоw". B) Please dont block the sender - this will prevent any legitimate shared documents from being sent to you. C) By clicking the link, it will redirect you to the Wells Fargo hyperlink image and by clicking anywhere it will redirect you to a fake Wells Fargo login page or it will automatically download an executable for remote access. D) Notice specifically the link with the L replaced with an i - welisfargo or other variants, such as wellsfargo-advisor or security-wellsfargo. Also notice, this site does have a valid Https certificate!! 

Do not follow the link, do not type any passwords. Report to IT immediately if you've done either. 

3/27/25: Request to Join Project Submissions

Key Points: A) Will come from a legitimate email that you probably know and have done business with. This person more than likely fell for the scam and compromised their email. B) Highlight the View Bid Dashboard and the link will point to webflow. C) By clicking the link, it will redirect you to a fake Google or Office 365 login page. D) Do not follow the link, do not type any passwords. Report to IT immediately if you've done either. 

3/24/25: Idaho DMV Text message

Key Points: A) Text will come from a non confirmed DMV number. B) The link included does not END with a .gov address. C) Idaho Does not have Tolls. D) Please note, this is not just an issue with Idaho. You may also receive these from other states and countries. Confirm with the local DMV if you have questions. Do not reply to the text itself.

3/24/25: Case File Legal Action

Key Points: A) Sender Email domain was not a legitimate Attorney domain B) The link in the Casefile points to a pandadoc which has another link that direct you to a fake Google or O365 login page. C) Do not follow the link or type your credentials into the fake websites. Immediately notify your IT if youve done either.