[Roundcube Announce] Phishing Alert

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view

[Roundcube Announce] Phishing Alert

Thomas Bruederli
Dear Roundcube vendors

We have been receiving many reports about phishing attempts appearing out in the wild which are targeting end users of webmail services powered by Roundcube. The fake emails pretend to come from „Roundcube Webmail“ or alike and trick users to enter their email password on fake sites. The attackers take advantage of the fact that most users think Roundcube is a service like Gmail or Hotmail and aren’t aware who is actually running their email: the individual hosting providers using the Roundcube software for their webmail service.

Please act now:

* Customize your Roundcube installation with your individual logo [1] and product name [2]. Make sure to configure the support_url [3] and provide proper guidance for your existing and new users.

* Inform your users about the ongoing phishing attempts and make them aware about who is responsible for the email system they are using every day. There is no thing like a „Roundcube webmail service“.

* Secure your SMTP server to deny sending with arbitrary sender addresses. This is a general suggestion but also helps avoiding fraudulent messages being sent from your hosts.

Help us to fight phishing and protect your users!

Kind regards,

Roundcube Announcement mailing list
[hidden email]