Remove “Update Server Terms Now” email

The “Update Server Terms Now” email is part of a phishing campaign that aims to steal users’ email login credentials. The email claims that the recipient’s email account will be terminated on a specific date unless users click on the provided button to indicate that they are still using the email account. Users who interact with the email will be taken to a phishing site imitating a legitimate email login page. Login credentials typed in on the phishing site will be stolen and sent to the malicious actors operating this phishing campaign.

 

 

The “Update Server Terms Now” phishing email is disguised as an alert from an email provider, supposedly informing the account holder about the upcoming deletion of the account. To pressure users into acting rashly, the email also mentions a specific date when the supposed deletion will happen. If users do not want their accounts deleted, the email asks them to confirm they’re still using the account by clicking the provided button.

If users believe this phishing attempt and click on the “I’m still using my email” button, they will be redirected to a phishing site where they will be prompted to log in to their accounts. Submitting their information will instantly transfer it to the cybercriminals behind this phishing campaign. Email account credentials are highly sought after because they provide access to various other accounts. Gaining unauthorized access to an email account can result in the hijacking of all linked accounts. If the malicious actors operating this phishing campaign don’t exploit the stolen credentials themselves, they often sell them to other criminals. What’s more, email accounts hold a lot of personal information, which malicious actors may exploit to target users.

Here is the full “Update Server Terms Now” email text:

Subject: Email termination is in progress for ********

******** IT-SUPPORT Update Server Terms now

Hello ********

Your email account: ******** will be terminated now: 12/29/2024

Note: Please Tap below and sign-in to indicate if you are still using this mailbox.

I’m still using my email please stop my email

How to recognize phishing emails

If you want to avoid falling victim to a phishing scam, it’s important to learn how to identify them. In many cases, the phishing emails are very low-effort and, thus, easy to recognize. Sophisticated and difficult-to-recognize phishing attempts are generally reserved for high-profile targets. Most users will deal with generic phishing attempts that target large numbers of users with the same campaign.

When dealing with unsolicited emails that have attachments or links, users should first check the sender’s email address and confirm it’s legitimate before interacting with the email. Many phishing emails come from obviously fake email addresses, making them easy to spot. More advanced phishing emails may come from credible email addresses, but a quick search with a search engine can reveal whether or not the address is legitimate. If you can’t find any information about the email address purportedly used by the company, it’s likely a phishing attempt.

Another red flag is grammar and spelling mistakes in the email. While many phishing emails are unsophisticated and filled with mistakes like missing punctuation or extra spaces, legitimate emails, especially concerning account security, will never have mistakes in them. This particular “Update Server Terms Now” is full of mistakes and looks very unprofessional, which is an immediate giveaway.

Regardless of how sophisticated a phishing email may be, the link provided in a phishing email will give it away. You can hover over the links with your mouse to see where the link will take them. If the site looks even remotely suspicious, do not click on it. It’s worth mentioning that malicious actors may try to disguise the links to make them seem legitimate by using deceptive tactics. For example, they may add additional or remove some letters. For example, instead of Gmail, the link may include the word Gmaill.

To protect against entering credentials on phishing websites, it is advisable to avoid clicking links in emails altogether. Instead, access your accounts directly through a web browser if you receive an email alerting you to an issue. While the fake site might mimic a legitimate one design-vise, the URL will always be a clear indicator of a scam. Users should make it a habit to examine the URLs of sites they visit; if anything seems off, do not enter login information.

Remove “Update Server Terms Now” email

If you receive this email but do not interact with it, you can just remove “Update Server Terms Now” email from your inbox. However, if you clicked on the link and typed in your email login credentials on a phishing site, you need to change your password immediately. If your account has been hijacked and you can no longer access it, try all the account recovery options. If the account cannot be recovered, you need to disconnect the email from all connected accounts.