There was recently a spear-phishing attempt that was sent out to Purdue users that attempted to trick them into logging into a fake myMail login page. The message itself appears legitimate with a spoofed sender of Administrator [mailto:email@example.com] and a disguised link that points to a malicious internal link.
Please be advised that the email is not legitimate and should be deleted or ignored. If you have clicked on the link and entered your account info, then you will need to change your password and challenge questions as soon as possible. At this time the internal page hosting the fake myMail authentication page has been disabled and further investigation is taking place on that matter.
Posted by ITSP - Security on April 19, 2013, in Secure Purdue News.