New UB account phish: Fake login and Duo pages

A graphic showing a smartphone with an alert on it.

A new phishing tactic is circulating that targets UB credentials by mimicking both a fake UB login page and a fraudulent Duo two-factor authentication page.

Portrait photo of Michael Canfield

By Michael Canfield
 IT Communication Specialist

Published November 11, 2024

A new phishing tactic has been circulating, aiming to steal UB credentials by simulating not only a fake UB login page, but also a fraudulent Duo two-factor authentication page. Here’s what you need to know to protect your account.

Take a look at this specific phish example

How this phishing attack works

  • Fake login page: Individuals receive an email prompting them to log in to what appears to be a UB page. This fake page accepts anything you enter – it doesn’t validate your credentials, but simply redirects you to the next step.
  • Fake Duo page: After the fake login page, individuals are taken to a counterfeit Duo two-factor authentication page. Here, the page requests a passcode specifically rather than providing the option to send a Duo push, which is the more common authentication method at UB. This is a key red flag: Duo should usually give you the option to receive a push notification. 
  • Account compromise: Once the attacker captures your Duo passcode, they gain full access to your account, allowing them to modify settings and add their own devices to your Duo profile. 

How to protect yourself

  • Verify Duo requests: Take an extra second to review your Duo login options. If you’re asked for a passcode instead of receiving a Duo push, stop what you’re doing. This discrepancy may indicate a phishing attempt.
  • Review devices in Duo: Regularly review your Duo account to ensure that all listed devices are familiar and authorized. Remove any devices that you don’t recognize. 
  • Be wary of unexpected login requests: If you weren’t trying to log in, but receive a Duo authentication prompt, this is a sign someone might be trying to access your account. If you do receive one, change your UBITName password immediately.

Need help? UBIT is here for you

If you have any reason to believe your UBITName account has been compromised, change your password immediately—log into the UBITName Manager, or contact the UBIT Help Center at 716-645-3542, or online at buffalo.edu/ubit/help.

If you believe you are the victim of identity theft, you can report the theft and make a recovery plan at identitytheft.gov.

You can always find the latest tips and alerts about cyber security on the UBIT website—just visit buffalo.edu/ubit/safe.

UB Information Technology News keeps UB students, faculty, and staff informed about their IT services and showcases creative collaborations between UBIT and the campus community. Published by the Office of the Chief Information Officer at UB and distributed via email as The Monthly Download. Edited by Diana Tuorto, IT Communication and Engagement, dianatuo@buffalo.edu.