Dear Roundcube vendors
We have been receiving many reports about phishing attempts appearing out in the wild which are targeting end users of webmail services powered by Roundcube. The fake emails pretend to come from „Roundcube Webmail“ or alike and trick users to enter their email password on fake sites. The attackers take advantage of the fact that most users think Roundcube is a service like Gmail or Hotmail and aren’t aware who is actually running their email: the individual hosting providers using the Roundcube software for their webmail service.
Please act now:
- Customize your Roundcube installation with your individual logo [1] and
product name [2]. Make sure to configure the support_url [3] and provide proper guidance for your existing and new users.
- Inform your users about the ongoing phishing attempts and make them aware
about who is responsible for the email system they are using every day. There is no thing like a „Roundcube webmail service“.
- Secure your SMTP server to deny sending with arbitrary sender addresses.
This is a general suggestion but also helps avoiding fraudulent messages being sent from your hosts.
Help us to fight phishing and protect your users!
Kind regards, Thomas
[1] https://github.com/roundcube/roundcubemail/blob/master/config/defaults.inc.p... [2] https://github.com/roundcube/roundcubemail/blob/master/config/defaults.inc.p... [3] https://github.com/roundcube/roundcubemail/blob/master/config/defaults.inc.p...