Dear State Employees,

Multiple users within state agencies were recently targeted and impacted by a successful phishing attack. A phishing campaign has been observed compromising internal accounts via malicious Google calendar invites. 

Employees should report suspicious messages and calendar invites immediately: Do not forward, reply to, or click links in a suspicious email and do not accept calendar invites that seem unusual. Use the "Report Phishing" button in your email client or contact the Maryland Security Operations Center (MD-SOC) at soc@maryland.gov or through the cybersecurity incident reporting form at https://doit.maryland.gov/cybersecurityincident. Prompt reporting allows our security team to block threats for all employees. If you believe that you have clicked on a malicious link, report it immediately to the MD-SOC. The MD-SOC operates 24x7. IT security incidents can be reported​ to soc@maryland.gov via email or by calling 410-697-9700, option 5.

Phishing attacks—fraudulent emails designed to manipulate recipients into revealing sensitive information, clicking malicious links, or downloading harmful attachments—continue to be a leading tactic used by malicious actors.

Please review the following red flags and best practices to keep our digital environment secure.

How to Spot a Phishing Email

Malicious actors often imitate leadership, state agencies, IT support, or familiar vendors. Watch out for these key indicators:

• Urgent or Threatening Language: Messages demanding immediate action (e.g., "Account suspended," "Immediate password reset required," or "Urgent wire transfer").
• Mismatched or Unfamiliar Sender Addresses: Look closely at the sender’s full email address, not just the display name. Check for slight misspellings or abnormal domain extensions like .org where you expect .gov.
• Suspicious Links & Attachments: Hover your cursor over links (without clicking) to verify the destination web address. Be cautious of unexpected attachments, and verify them with the sender using an alternative medium to email such as a call to a known good number..
• Requests for Sensitive Information: IT will never ask for your password. Be wary of requests for other sensitive information such as your Social Security number or personal financial details via email, and verify such requests with the sender through an alternative medium.

Core Best Practices for Cybersecurity

Adopting a few daily security habits significantly reduces risk across all state operations:

1. Verify Before You Act: If an email seems unusual or requests sensitive actions—even if it appears to come from a supervisor, frequent contact, or vendor—verify the request through a secondary, trusted communication channel (like a phone call or direct message). Malicious links and attachments can also come in the form of calendar invites, so be suspicious of any unexpected invites you receive or that appear on your calendar and verify them. Verify the legitimacy of any website that requests your username or password before entering them. Phishing is frequently used to gather credentials and gain access to accounts. Malicious actors can identify common web portals used by state employees and create convincing fakes, so a familiar website appearance does not guarantee the authenticity of the website. If you have any doubt about the authenticity of a website do not enter any information and contact the MD-SOC for help.
2. Use Multi-Factor Authentication (MFA): Ensure MFA is enabled across all accessible state systems to prevent unauthorized access even if credentials are compromised.
3. Practice Strong Password Hygiene: Never reuse passwords across work and personal accounts. Use long, unique passphrases.
4. Report Suspicious Messages Immediately: Do not forward, reply to, or click links in a suspicious email. Use the "Report Phishing" button in your email client or contact the Maryland Security Operations Center (MD-SOC) at soc@maryland.gov or through the cybersecurity incident reporting form at https://doit.maryland.gov/cybersecurityincident. Prompt reporting allows our security team to block threats for all employees.

Thank you for your continued dedication to keeping our state network safe and resilient.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Note from UMBC's Cybersecurity Assurance and Digital Trust Team: 

If you suspect phishing, please contact us at security@umbc.edu/