Remove “Avoid Getting Locked Out” email

The “Avoid Getting Locked Out” email is part of a phishing campaign that targets users’ Webmail login credentials. The email is disguised as a notification email from the email service provider Webmail and asks that users re-authenticate their accounts. If recipients fail to re-authenticate their accounts, they may be locked out. The email provides a button for users to click to supposedly re-authenticate. However, if users were to click on it, they would be taken to a phishing site that asks users to log in. If users type in their login credentials, they will be immediately sent to the malicious actors operating this phishing campaign.

 

 

The “Avoid Getting Locked Out” email is made to look like a security notification from Webmail, supposedly to inform users that they need to re-authenticate their accounts. Failure to do so could potentially result in users being locked out of their accounts. The email contains a “Re-authenticate Now” button, clicking which would take users to a phishing site. The site may closely resemble that of Webmail and look convincing enough to trick less-attentive users. If users fall for the phishing attempt and type in their login credentials, they will be stolen. This would allow malicious actors to access users’ email accounts.

Email credentials are very valuable for malicious actors, as they provide access to a wide range of personal information and are often connected to various other accounts. If an email account is compromised, it can also result in the hijacking of most if not all linked accounts. Therefore, it’s important for users to protect their email login information, as losing access to an email account can lead to serious consequences.

Users who have fallen for this phishing campaign have to change their passwords immediately if they can still access their accounts. If the accounts are no longer accessible and recovery options do not work, users have to disconnect the email address from all connected accounts.

The full “Avoid Getting Locked Out” phishing email is below:

Subject: Ref: Avoid getting locked out – New Request for – – Friday, March 7, 2025

– Webmail

This is a mandatory service communication

Avoid Getting Locked Out

Due to recent mail server update, we recommend you to re-authenticate – to avoid getting locked out of your account.

Re-authenticate Now

Message ID: –

Email: –
Date: Friday, March 7, 2025

This message from ******** is an important communication
One Microsoft Way, Redmond, WA 98052 USA

Signs of a phishing email

Many phishing campaigns tend to be quite generic because the emails need to target a large number of users. These are often easy to spot as phishing attempts. More sophisticated phishing campaigns target specific, high-profile people or companies. Tailored phishing emails can appear very legitimate and may even deceive the most vigilant users if the circumstances are right. Fortunately, most people are unlikely to be the focus of such targeted attacks. Thus, by being aware of the most common signs, users can typically identify phishing emails fairly easily.

Upon receiving an unsolicited email requesting immediate action—like clicking a link or downloading an attachment—it’s very important to verify the sender’s email address before doing anything. A quick search online can help confirm whether the email address genuinely belongs to the person or organization it claims to represent. In simpler phishing campaigns, the email addresses may seem obviously suspicious, as they often appear random. However, some attackers use clever strategies to make their email addresses more convincing, such as substituting letters (e.g., using “rn” for “m”) or adding extra characters to mimic trusted senders. In this particular case, the “Avoid Getting Locked Out” email is very obviously not sent by Webmail as the sender’s address does not use the service provider’s domain.

Obvious grammar and spelling mistakes in emails that are supposed to be professional can also signal that an email is malicious. Surprisingly, many phishing emails contain a significant number of mistakes and awkward phrasing that you wouldn’t normally see in emails from a reputable service provider. For example, this “Avoid Getting Locked Out” email does not have much text but the phrasing still sounds quite awkward.

Users should take the time to inspect emails and never rush when it comes to clicking on links or opening attachments. Users can hover over links with their mouse to check where a link/button will take them. Unsolicited email attachments should be scanned with anti-virus software or VirusTotal to ensure they’re not malicious before opening them.

Finally, we suggest that users refrain from clicking on links found in emails altogether. If users receive an email notifying them about a problem with their account and requesting that they click on a link to resolve it, users should consider logging into their account manually to check instead of clicking any link provided.