Security advisory

Recommendations

In addition to continually monitoring our services for malicious use, Autodesk provides security controls within our products to help customers lower their susceptibility to phishing attempts like these. To reduce the risk of a phishing attempt, please make sure you follow the recommendations below:

• Please be cautious when enabling public link sharing. Public link sharing in Autodesk Docs is turned off by default. This means file sharing recipients must be authorized to use Autodesk Docs and be logged into view the document.
• Use Autodesk’s 2-step verification setting for your accounts to reduce the risk of an attacker accessing your Autodesk account.

We also recommend employing the following best practices to identify and report suspected malicious links and files.

• When receiving an email with an embedded link or attached file, employ healthy skepticism:
  • Is the email address and/or username familiar? Do you know the user?
  • Were you expecting to receive a shared file from this user?
  • If the answer is no, avoid clicking links within the email or opening file attachments.
  • Does the email convey a sense of urgency or use threats? Phishing emails often use urgent language or threats to create a sense of panic.
  • Is the sender requesting personal or sensitive information? A legitimate sender should never ask for sensitive information like credit card numbers, insurance or Social Security numbers via email. Be wary of any email requesting such information.
• If you receive a suspicious link, report it to the Autodesk Incident Response Team via this contact form. Include a description of how you received the link and the full URL of the link.
• You can also contact us with other inquiries here. If we find any violation of Autodesk Acceptable Use Policy, such as phishing, malware, or spam, we will take immediate action.

We are committed to continuous improvement of our security scanning capabilities to prevent bad actors from misusing our cloud services to host malicious content or any other violation of Autodesk policies.