IT Setup Guide — stopping the folder-share phishing campaign

Copy-paste recipes for practice IT providers. Each layer is independent — do as many as apply. Layers 1–3 protect every device including the Outlook desktop app and phones; no browser extension needed.

Coverage map — what protects what

LayerProtectsEffort
1. Mail server rule (M365 / Google Workspace)Every device and mail client, all staff — email is tagged/quarantined before delivery15 min, admin access
2. DNS filtering at the routerEvery device on the practice network, every browser and app — the malicious site simply won't load15 min, router access
3. Account & endpoint hardening (2FA, non-admin, app control)Makes a click survivable and stops mailbox takeoveran afternoon
4. Browser extension (Chrome / Edge / Firefox)Visible red warning inside Gmail / Outlook web2 min per PC
5. Poster + staff trainingEvery human, including desktop-Outlook and phone readers no software reaches15-min team meeting

1a. Microsoft 365 — mail flow rules (covers desktop Outlook)

For practices on Microsoft 365 / Exchange Online — i.e. most practices using the Outlook desktop app. Needs a tenant admin.

Admin center (point-and-click)

  1. Go to admin.exchange.microsoft.com → Mail flow → Rules → Add a rule → Create a new rule.
  2. Rule 1 — quarantine known-bad links: Apply if "The subject or body → subject or body includes any of these words" → add: .vu/ — Do the following: "Redirect the message to → hosted quarantine". Severity: High.
  3. Rule 2 — warn on share-lure wording from outside: Apply if "The sender → is external/internal → Outside the organization" AND "subject or body includes": shared a file with you, shared a folder with you, shared a file for you — Do the following: "Apply a disclaimer → prepend" with the HTML below. This tags the email with a red warning banner that shows in EVERY client, including desktop Outlook and phones.
<div style="background:#fdecea;border:3px solid #b71c1c;padding:12px;font-family:Arial;font-size:14px">
<b style="color:#b71c1c;font-size:16px">⚠️ CAUTION — "shared file" email from outside the practice</b><br>
A phishing campaign is hitting Australian dental clinics with fake "shared a file" emails sent
from hacked colleagues' real accounts. Before opening any link: PHONE the sender and confirm
they sent it. Never open share links "on your desktop" because the email says to.
</div>

PowerShell (equivalent, for IT providers)

Connect-ExchangeOnline

New-TransportRule -Name "PhishWatch 1 - quarantine .vu links" `
  -SubjectOrBodyContainsWords ".vu/" `
  -Quarantine $true -SetAuditSeverity High

New-TransportRule -Name "PhishWatch 2 - external share-lure warning" `
  -FromScope NotInOrganization `
  -SubjectOrBodyContainsWords "shared a file with you","shared a folder with you","shared a file for you" `
  -ApplyHtmlDisclaimerLocation Prepend `
  -ApplyHtmlDisclaimerText '<div style="background:#fdecea;border:3px solid #b71c1c;padding:12px;font-family:Arial;font-size:14px"><b style="color:#b71c1c;font-size:16px">⚠️ CAUTION — "shared file" email from outside the practice</b><br>A phishing campaign is hitting Australian dental clinics with fake "shared a file" emails sent from hacked colleagues' real accounts. Before opening any link: PHONE the sender and confirm they sent it.</div>' `
  -ApplyHtmlDisclaimerFallbackAction Wrap

Also worth enabling if licensed (Defender for Office 365): Safe Links with "apply real-time URL scanning". Update Rule 1's word list as new attack domains appear.

1b. Google Workspace — content compliance

For practices whose email runs on Google Workspace (Gmail with your own domain). Needs super-admin.
  1. admin.google.com → Apps → Google Workspace → Gmail → Compliance.
  2. Under Content compliance → Configure. Affect: Inbound.
  3. Add expression: "Simple content match" → .vu/ (add more as new patterns appear).
  4. Action: Quarantine message (review quarantines in Admin console) — or "Modify message → Prepend custom subject" with [SUSPECTED PHISHING] if you prefer tagging over holding.
Plain @gmail.com practice accounts can't do server-side rules. For those: the browser extension + poster, plus the DNS layer below, and strongly consider moving practice email onto Workspace or M365 — server-side control is worth it.

2. DNS filtering at the router — protects every device, every browser, every app

Works no matter what email client or browser anyone uses: even if someone clicks, the malicious site fails to load on the practice network. One change on the router.

Option A — Quad9 (free, zero accounts)

Router admin page → DNS settings → set DNS servers to 9.9.9.9 and 149.112.112.112. Quad9 blocks domains on threat-intelligence lists automatically (including reported campaign domains once flagged — another reason to report sightings).

Option B — NextDNS (free tier, more control)

  1. Create a config at nextdns.io; point the router's DNS at the two addresses it gives you.
  2. In Denylist, add vu — this blocks the entire .vu domain ending on your network. Legitimate business email from .vu sites is essentially nonexistent in Australian dentistry, so the collateral damage is nil, and every future wave on .vu is dead on arrival regardless of the specific domain.
  3. Add other risky endings as waves appear (icu, top, cyou…), and enable "Threat Intelligence Feeds" + "AI-Driven Threat Detection" in Security settings.

3. Account and endpoint hardening (makes a click survivable)

4. Browser extension (Chrome, Edge, Firefox)

5. Humans (the layer nothing can replace)

Print the DO NOT OPEN poster for the front desk, run the staff booklet as a 15-minute team meeting, and establish the one rule that defeats every future variant: unexpected share link → phone the sender before clicking.