Phishing message sent to closed higher ed Registrar list

["Manjak, Martin" <mmanjak () ALBANY EDU>]

Good morning all,

My registrar forwarded the following phishing message sent to a closed list yesterday. It originated from a compromised 
account belonging to Cynthia Suter, the Registrar for Heidelberg University 
(www.heidelberg.edu<http://www.heidelberg.edu>). (I've already confirmed this by phone with them.)

If your Registrar subscribes to this list, they received this message, and they may have clicking on the link which 
points here: http://drive.ssl-secure.cloudns.pro/document/d/0WMPgfJDhfuD/shared/

If they filled out the form, they have exposed their credentials.

Here's the message that was sent to the list yesterday:
===================================================================================

From: Regist-L [mailto:REGIST-L () listserv gsu edu] On Behalf Of Cynthia Suter
Sent: Thursday, February 26, 2015 1:35 PM
To: REGIST-L () LISTSERV GSU EDU<mailto:REGIST-L () LISTSERV GSU EDU>
Subject: Doc

Here is the document Doc<http://drive.ssl-secure.cloudns.pro/document/d/0WMPgfJDhfuD/shared/>

Cynthia A. Suter
University Registrar
Heidelberg University
310 East Market Street
Tiffin, OH 44883
Phone 419-448-2092
Fax 419-448-2122

Purpose with Distinction.
This email and any files transmitted may contain confidential information as protected by the Family Educational Rights 
and Privacy Act (FERPA), 20 USC, section 1232g and/or the Electronic Communications Privacy Act, 18 USC, sections 
2510-2521. If you are not the intended recipient, you are hereby notified that any disclosure, copying or distribution 
is prohibited. If you have received this electronic communication in error, please notify me by telephone or return 
email and delete this message from your system completely.

=====================================================================================


Martin Manjak
CISSP, GIAC-GSEC
Information Security Officer
University at Albany
1400 Washington Ave., MSC 209
Albany, NY 12222
518/437-3813