Hackers Use Hijacked University Emails to Scam Students, Pose as FBI Agent
Proofpoint uncovers hackers using compromised university accounts to send fake job offers, steal credentials, and run gift card scams, including FBI impersonation.
Cybercriminals are targeting university students with fake employment opportunities sent from compromised higher education email accounts. Research shared with Hackread.com by Proofpoint shows a multi-stage attack chain that starts with credential theft and can lead to account takeover (ATO) and advance-fee fraud (AFF).
Fake Account Warnings Steal University Credentials
The campaigns begin with emails warning students, staff, or alumni that their university account is due to be deactivated because of retirement, graduation, or transfer. Recipients are sent to credential-harvesting forms hosted on legitimate services including Google Forms, Microsoft Office, Wix, Jotform, and Zoho Forms.
To get around form restrictions on password collection, some pages avoided the word “password” and told victims to enter it under a field labelled “WORDWORD.” The forms also collect personally identifiable information (PII...
Copyright of this story solely belongs to hackread.com. To see the full text click HERE
