Caution! Password Fishing!

Current phishing emails at BOKU!

What is phishing?

Phishing (= password fishing) is an attempt to obtain your BOKU login credentials (login name and password) via fake e-mails and websites.
Therefore, always pay attention to the actual sender e-mail address (and not to the name).
Before clicking on a link, always pay attention to the address (URL) that your web browser displays in the lower left corner, and never enter your login credentials at other than known BOKU servers!

If you subsequently realize that you have entered your password on an external server, please change your password immediately and contact your IT Managers, ITSG contact person and/or the BOKU-IT hotline.

Always pay attention to the actual sender address!
Buying gift cards? Doesn't that seem strange to you?

“Können Sie etwas für mich erledigen?”, 
“Can i entrust you with a task?”, “Urgently Needed”.

A BOKU professor is asking you to buy Apple gift cards?

Doesn't that seem strange to you?

Watch for red flags
Supposedly shared OneDrive or SharePoint files

You receive a message without any prior notice or context that a Microsoft OneDrive or SharePoint file has been shared with you.

Currently phishing emails with the following subject heading circulate:

  • “Ihre Leistungsauszahlung ist bereit”
    Watch out for red flags: the sender's address, pressure to respond quickly, …
     
  • “Sprachnachricht”
    Mailtext: “Sie haben eine neue Voicemail von + 49 7231 28 6__ erhalten. Diese Voicemail wurde über Microsoft Voice gesendet. Klicken Sie hier, um sie anzuhören.”
     
  • “BOKU Groupwise aktualisieren”
    Mailtext: “Die Groupwise-Webanwendung die BOKU (@boku.ac.at) wird aufgrund des hohen E-Mail-Aufkommens derzeit im Rahmen der jährlichen Wartungsarbeiten an unseren Mailservern gewartet. Sie sind verpflichtet, Ihr Konto zu aktualisieren, um Anmeldeunterbrechungen und den Verlust von E-Mails zu vermeiden.”
    If you have entered your BOKU credentials: Change your password immediately: https://short.boku.ac.at/it-change-password  and report the incident to BOKU-IT Hotline!
     
  • “Action Required: Account Upgrade”
     
  • “… shared "{Universität für Bodenkultur Wien (BOKU)} Fall Semester Preparation and Course Schedule Review" with you”
    If you have entered your BOKU credentials: Change your password immediately: https://short.boku.ac.at/it-change-password  
    and report the incident to BOKU-IT Hotline!
     
  • “Aktion erforderlich: Zurückgehaltene Nachrichten überprüfen”
    Mailtext: “Boku Benachrichtigungssystem …@boku.ac.at Sichere Postfachbenachrichtigung; Aktion erforderlich: Zum Schutz Ihres Posteingangs wurden 8 neue Nachrichten vorübergehend zurückgehalten. Klicken Sie auf die Schaltfläche unten, um die Nachrichten zu überprüfen und für Ihren Posteingang freizugeben. Mit freundlichen Grüßen, Boku Postfachadministrator © 2026”
    If you have entered your BOKU credentials: Change your password immediately: https://short.boku.ac.at/it-change-password  
    and report the incident to BOKU-IT Hotline!
     
  • “A login from a risky location has been detected. Protect your service now.”
     
  • "… shared "BOKU University Academic Programs, Research, and Development" with you"
    “ha compartido"Universität für Bodenkultur Wien (BOKU)-Latest Semester Schedule and 2026 Employee Benefits Plan1" contigo”
    “ … shared "University of Natural Resources and Life Sciences Vienna has added you as a signatory _Review and Sign" with you”
    If you have entered your BOKU credentials: Change your password immediately: https://short.boku.ac.at/it-change-password  
    and report the incident to BOKU-IT Hotline!
     
  • “Maßnahme erforderlich: Aktualisieren Sie Ihr Uni-E-Mail-Konto bis 13. Mai 2026”
    If you have entered your BOKU credentials: Change your password immediately: https://short.boku.ac.at/it-change-password  
    and report the incident to BOKU-IT Hotline!
     
  • “E-mail Security Updateᵀᴹ”
     
  • Emails said to have not been delivered
    “Three (3)  Incoming mails not delivered”
    “Pending Incoming Mails - Boku”
    “Benachrichtigung: 9 Nachrichten werden nicht übermittelt”
    "2 Nicht zugestellte Nachrichten"
    Do you see the pattern? You receive an email (!) telling you that you aren't receiving any emails? Isn't that strange?
    It’s an example of “social engineering” (https://en.wikipedia.org/wiki/Social_engineering_(security) ): No one wants to miss emails, so the temptation is strong to check this supposedly undelivered email. But why would that be possible through a dubious website?
     
  • “Microsoft 365: Ultimatum – Ablaufende Frist, Datenverlust unvermeidbar!”
     
  • “Are you on campus?”, "A moment?"; "Are you around?"; "Are you available?"; "Request"; "Work"
    (Allegedly sent by BOKU members, but actually from external email addresses, e.g. Gmail.)
    "If you have a minute, could you please drop an email.";
    "Help Needed,email me back asap"; 
    "Hello are you available? Please, l need your assistance urgently"
    This does NOT mean that the accounts of BOKU members have been hacked, the mails are sent from external Gmail accounts. Always pay special attention to the actual sender address!
    It would be very strange if a BOKU professor asked you to buy Apple gift cards, wouldn't it?
    Therefore, there is no need for action, and no risk of financial loss, as long as subsequent requests to buy gift cards are not responded to.
     
  • “Bitte lesen Sie: Wichtige Mitteilung der Universität für Bodenkultur Wien”
    Mailtext: “Hallo Mitarbeiter, Sie haben eine neue E-Mail-Benachrichtigung vom Mitarbeiterportal erhalten.”
    If you have entered your BOKU credentials: Change your password immediately: https://short.boku.ac.at/it-change-password  
    and report the incident to BOKU-IT Hotline!
     
  • "Notification: Password Warning”
     
  • “Webmail 2.30 – Boku Important emails remain suspended on the server”
     
  • “Passwort abgelaufen …@boku.ac.at”
    Mailtext: "Hallo …@boku.ac.at, Ihr Kontopasswort läuft heute ab, 2025-03-24 02:20. E-Mail-Dienstvorgänge wie "Senden und Empfangen" können eingeschränkt sein, wenn keine Maßnahmen ergriffen werden. Sie können Ihr Passwort ändern oder das aktuelle Passwort weiterhin verwenden. AKTUELLES PASSWORT BEIBEHALTEN. Copyright © 2025  ionos boku.ac.at"
     
  • “Benachrichtigung: 9 Nachrichten werden nicht an …@boku.ac.at übermittelt”
    Mailtext: "Sehr geehrter  …@boku.ac.at, Sie haben am 18.03.2025 9 nicht erhaltene E-Mails. Dies war auf eine Systemverzögerung zurückzuführen. Korrigieren Sie die Lösung unten.
    Ausstehende Nachrichten auf dem Mailserver anzeigen" 
    If you have entered your BOKU access data in the form:
    Please change your password immediately: https://short.boku.ac.at/it-passwort-aendern  
    and report the incident to BOKU-IT Hotline!
     
  • Mailtext: "Hallo …
    Wie sieht Ihr Terminplan für heute aus? Da ich Sie brauche, um eine Aufgabe für mich zu erledigen, brauche ich auch Ihre Handynummer, um mir bei der Aufgabe zu helfen.
    Mit freundlichen Grüßen,
    Eva Schulev-Steindl 
    Rector University of Natural Resources and Life Sciences, Vienna (BOKU)"
     
  • "boku.ac.at Server - Passwort abgelaufen"
    Mailtext: "Das Passwort zu Ihrem mailbox ... abgelaufen"
     
  • "Update Required"
    Mailtext: "We have just finished general email security update for our domain boku.ac.at.
    The user of ...@boku.ac.at is required to confirm your email is valid and still in use."
    This mail is phishing!
    If you have entered your BOKU access data in the form:
    Please change your password immediately: https://short.boku.ac.at/it-passwort-aendern  
    and report the incident to BOKU-IT Hotline!
     
  • "BOKU Finanzabteilung" (or other internal sender)
    "Scheck zurückgegeben" or "Lohnzettel" or "Zahlung zurückgegeben" or 
    "Ihre Bank hat eine Überweisung Ihrer Gehaltszulagen für die Monate Juni, Juli und August abgelehnt." or "Das beiliegende Gehaltsdokument bedarf dringend Ihrer Aufmerksamkeit"
    Clicking on the external link redirects to a fake GroupWise Web Access login.
    If you have entered your BOKU access data in the form:
    Please change your password immediately: https://short.boku.ac.at/it-passwort-aendern  
    and report the incident to BOKU-IT Hotline!
     
  • "BOKU-IT-Hotline - Support"
    "Sie haben 5 ausstehende E-Mails"
    If you have entered your BOKU access data in the form:
    Please change your password immediately: https://short.boku.ac.at/it-passwort-aendern  
    and report the incident to BOKU-IT Hotline!
     
  • "2 Nicht zugestellte Nachrichten"
    "Es stehen noch Nachrichten für Ihren Posteingangsordner aus."
     
  • "IT-Sicherheitshinweis"
    "Ihr E-Mail-Passwort läuft in 2 Tagen ab, um E-Mail-Passwort und Details zu behalten, KLICKEN SIE HIER, um es sofort zu aktualisieren"
     

These emails seem to come from BOKU addresses. However, these emails do NOT come from BOKU-IT. Please delete them.

We ask for your help: 

  • If you receive a phishing email that is listed above - despite our extensive counter measures - please delete this email without any further response.
  • If you receive a phishing email that seems to come from BOKU and is not listed here, please inform the BOKU-IT hotline so that we can start counter measures as quickly as possible. Also in this case, do not respond to the phishing emails or internet addresses stated in such emails. 

Please note:

This list as well as notifying BOKU-IT is only for phishing attempts directed at BOKU's IT accounts.

Other phishing emails that are directed at bank accounts or other systems outside BOKU are not especially treated by us. Other phishing attempts are not listed and do not need to be reported. Of course, you should also delete these emails without any further response. 

Further information on phishing can be found here:

Contact & Support

Do you need further information?

See also