Remove “Sign-in From Unauthorized Geolocation” email

The “Sign-in From Unauthorized Geolocation” email is part of a phishing campaign that aims to steal your email login credentials. The email falsely claims that someone tried to log in to your email account from an unauthorized geolocation. The email asks that you reset your password if you do not recognize the login attempt. However, if you were to click on one of the links in the email, you would be redirected to a phishing site that asks you to log in. If you fall for this phishing attempt and type in your login credentials, they will be stolen and sent to the malicious actors operating this phishing campaign. This would lead to unauthorized access of your account.

 

 

The “Sign-in From Unauthorized Geolocation” email is a classic phishing attempt. It’s quite generic and immediately identifiable as phishing. It informs recipients that there has been an unidentified login from North Korea. The email includes several links for users to supposedly secure their accounts.

If you click on any of the links, you will be redirected to a phishing website that closely imitates your email provider’s legitimate login page. The site asks that you log in to your account, and if you do, that information goes directly to the cybercriminals operating this phishing campaign. These cybercriminals may either use the stolen credentials themselves or sell them to other malicious actors.

Email login credentials are particularly valuable because an email account often contains a lot of sensitive information and is connected to many other accounts. By gaining access to an email account, cybercriminals can access various other services and even blackmail the account holder.

The full text from the “Sign-in From Unauthorized Geolocation” phishing email is below:

Subject: Unusual mail sign-in from unauthorized geolocation

Mail account
Unusual mail sign-in from unauthorized geolocation
We detected something unusual about a recent sign-in to your mail account – on – from an unauthorized geolocation.
If this was you, then you can safely ignore this email.
Country/region: North Korea
Platform: One UI
Browser: Naenara
IP address: –
If this wasn’t you, your account has been compromised. Please follow these steps:
1. Reset your password.
2. Review your security info.
3. Learn how to make your account more secure.
You can also opt out or change where you receive security notifications.

How do you recognize phishing emails?

A lot of phishing campaigns are easily identifiable because they are quite generic. The emails target many users with the same emails, which is why they are not personalized and very generic. They’re also usually very poorly done. In contrast, phishing emails targeting high-profile individuals or organizations are typically more sophisticated and can be harder to identify. Fortunately, most people mostly encounter generic phishing emails.

When dealing with unsolicited emails, the first thing you need to do is check the sender’s email address. In some cases, the email address is immediately obvious as it looks random and unprofessional. In order cases, the address may look legitimate. We recommend that you at least research the addresses before you interact with the email. Oftentimes, even a simple search with Google is enough. We should also mention that malicious actors can make their email addresses appear more legitimate by switching letters or adding extra characters, making them similar to legitimate companies’ email addresses.

Grammar and spelling mistakes in an email that’s supposed to be legitimate also give it away. For whatever reason, low-effort phishing attempts often have a lot of mistakes. This particular email is more sophisticated and does not have obvious mistakes, but the phrasing sounds rather awkward. The email also does not address you by name or at all, which is another giveaway. If you were to receive an email from a legitimate company, you would be addressed by your name.

Finally, we recommend you avoid clicking on links in emails altogether. If you receive an email about an issue with your account, log in to the account manually and check the issue instead of clicking on a link. You should also scan all unsolicited email attachments with an anti-malware program or VirusTotal.

How to remove “Sign-in From Unauthorized Geolocation” phishing email

If you receive this “Sign-in From Unauthorized Geolocation” email, pay no attention to its contents and simply delete it. If you have already opened the email, clicked on the link, and entered your login information, change your password immediately, assuming you still have access to your account.

If you can’t access your email, try all the account recovery options. To minimize the risk of other accounts being compromised, disconnect your email from any linked accounts if you can no longer access it.