Dear Roundcube vendors
We have been receiving many reports about phishing attempts appearing out
in the wild which are targeting end users of webmail services powered by
Roundcube. The fake emails pretend to come from „Roundcube Webmail“ or
alike and trick users to enter their email password on fake sites. The
attackers take advantage of the fact that most users think Roundcube is a
service like Gmail or Hotmail and aren’t aware who is actually running
their email: the individual hosting providers using the Roundcube software
for their webmail service.
Please act now:
* Customize your Roundcube installation with your individual logo [1] and
product name [2]. Make sure to configure the support_url [3] and provide
proper guidance for your existing and new users.
* Inform your users about the ongoing phishing attempts and make them aware
about who is responsible for the email system they are using every day.
There is no thing like a „Roundcube webmail service“.
* Secure your SMTP server to deny sending with arbitrary sender addresses.
This is a general suggestion but also helps avoiding fraudulent messages
being sent from your hosts.
Help us to fight phishing and protect your users!
Kind regards,
Thomas
[1]
https://github.com/roundcube/roundcubemail/blob/master/config/defaults.inc.…
[2]
https://github.com/roundcube/roundcubemail/blob/master/config/defaults.inc.…
[3]
https://github.com/roundcube/roundcubemail/blob/master/config/defaults.inc.…
