As incoming freshman students begin using their WSU emails, hackers who target university email accounts have a new set of victims to try to collect personal information from.

The problem of phishing emails has been ongoing at WSU for some time, and by its nature it is unlikely to end, WSU Information Technology Services (ITS) leaders stated in an email. Though the university has security defenses in place, some malicious emails are able to bypass them.

“It’s an arms race of sorts,” ITS leaders wrote in an email. “As one side finds a successful counter to the other side’s current tactics, the first side must in turn develop new tactics, and on and on it goes.”

They stated that most phishing messages actually come from compromised WSU email accounts. They often include links and attachments containing malware, and clicking on these makes users vulnerable to loss of personal or sensitive information, as well as corruption of the device being used to access the emails.

Another threat is the installation of ransomware, a type of malware which essentially blocks access to the device until the user pays a sum of money. These cases are less common, and the most frequent issue for students is forced password reset.

However, after compromising an account, ITS leaders stated that hackers sometimes set email rules which send the account’s emails to a third-party address from which they can monitor them. Other times they set rules to delete responses to emails from the compromised account, so students can’t see their account is being used this way.

“This can obviously cause significant interruption for the impacted student,” ITS leaders wrote.

It can be difficult to distinguish phishing emails from legitimate WSU emails. ITS leaders advise students to confirm that links come from a valid source before accessing them. To avoid confusing students, ITS strives not to include links in its emails.

“This is why these hackers can be so successful,” ITS leaders wrote. “They utilize standard communications technology methods.”

When in doubt, ITS leaders recommend students not click on any link or attachment unless they are confident of its source. If students receive an unexpected email from someone they know, they should check with the person before accessing its content.

ITS leaders ask that students forward suspicious emails to [email protected], and contact CougTech if they click on a link or attachment containing malware. Overall, the best advice is to question the validity of emails, to think before clicking on links and attachments, ITS wrote.

“There is no end solution,” ITS leaders wrote, “because the situation is inherently adversarial … with human minds on both sides endlessly trying to outsmart each other.”

Reporting by Cody Cottier