Skip to main content

Cornell University

IT@Cornell

New Message from Randy [Surname]

This phish typically originates from a non-Cornell email address. The sender may appear as "Randy [Surname] <[user]@wxxi.org>". The link within directs to a PDF with a fake OneDrive notice hosted via Cloudinary. The PDF contains a link to a fake login page. If you entered your credentials into the page, change your NetID password immediately at https://netid.cornell.edu.
A fake OneDrive-branded notification with the heading "NEW FAX DOCUMENT(S) HAS BEEN RECEIVED"
OneDrive NEW FAX DOCUMENT(S) HAS BEEN RECEIVED Reference #: (281) 309-9361 Result Code: SUCCESS Pages: 1 PREVIEW DOCUMENT HERE

 

At Cornell we value your privacy. To view
our university's privacy practices, including
information use and third parties, visit University Privacy.