[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFg-aJcxMp_LANIGfR2eyksA1ZnX2md4vBmA63qYt1W8":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"2ff87bd5-fce5-4e2a-ac8b-12d18a00ff51","Hackers Use Hijacked University Emails to Scam Students, Pose as FBI Agent","hackers-use-hijacked-university-emails-to-scam-students-pose-as-fbi-agent-2b01c4","Students, job seekers and university staff, watch out for fake job offers sent from legitimate university email accounts.","Proofpoint has identified a scam campaign where threat actors compromise university email accounts to send fake job offers to students and staff. The attackers first steal credentials using phishing forms hosted on legitimate services, then use the compromised accounts to distribute fraudulent job opportunities. The scam escalates to advance-fee fraud, where victims are sent fraudulent checks and instructed to purchase gift cards with the proceeds, with some impersonating FBI agents.","Hackers use compromised university emails for fake job offers and gift card scams.","https:\u002F\u002Fhackread.com\u002Fhackers-hijacked-university-email-scam-students-fbi-agent\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002Fhackers-hijacked-university-emails-scam-students-fake-jobs-1024x640.jpg","2026-09-29T16:30:47+00:00","2026-09-29T18:00:50.356507+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Google Forms","product",{"name":21,"type":19},"Microsoft Office",{"name":23,"type":19},"Wix",{"name":25,"type":19},"Jotform",{"name":27,"type":19},"Zoho Forms",{"name":29,"type":30},"Proofpoint","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},[],[29,18,21],{"controls":52,"vendors":135},[53,82,110],{"slug":54,"name":55,"problem":56,"products":57},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":83,"name":84,"problem":85,"products":86},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[87,94,102],{"vendor_slug":88,"vendor_name":29,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"slug":111,"name":112,"problem":113,"products":114},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[115,121,128],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":116,"product_name":117,"url":119,"description":120},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":122,"product_name":125,"url":126,"description":127},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":111,"product_name":132,"url":133,"description":134},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[136],{"slug":88,"name":29,"logo_path":89,"roles":137},[138],"reported_by",{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":155},"hijacked-university-emails-used-to-scam-students-via-phishing-and-advance-fee-fraud","Hijacked University Emails Used to Scam Students via Phishing and Advance-Fee Fraud","Threat actors are exploiting weak credential hygiene within university environments by using phishing forms hosted on legitimate platforms to harvest login credentials, then weaponizing those trusted email accounts to distribute fraudulent job offers. Because the emails originate from legitimate university domains, traditional spam filters and recipients alike are far more likely to trust them, amplifying the attack's effectiveness. The scam escalates into advance-fee fraud, with victims manipulated into purchasing gift cards and even facing impersonation of federal law enforcement agents. This attack chain demonstrates how a single compromised credential can cascade into significant financial and reputational harm for both the institution and its students. It underscores the critical need for multi-factor authentication and ongoing phishing awareness education in academic settings.",[144,145,146,147,148,149,150,151,152,153,154],"CIS Control 4 – Controlled Use of Administrative Privileges","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 IA-5 – Authenticator Management (MFA)","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AT-2 – Security Awareness Training","NIST Phishing Guidance SP 800-177","GDPR Article 32 – Security of Processing (for institutions handling EU student data)","ITIL – Service Security and Incident Management Practices",{"NIST Phishing Guidance SP 800-177":156,"NIST SP 800-53 AC-2 – Account Management":157,"CIS Control 6 – Access Control Management":158,"CIS Control 17 – Incident Response Management":159,"NIST SP 800-53 SI-3 – Malicious Code Protection":160,"NIST SP 800-53 AT-2 – Security Awareness Training":161,"NIST SP 800-53 IA-5 – Authenticator Management (MFA)":162,"CIS Control 14 – Security Awareness and Skills Training":163,"ITIL – Service Security and Incident Management Practices":164,"CIS Control 4 – Controlled Use of Administrative Privileges":165,"GDPR Article 32 – Security of Processing (for institutions handling EU student data)":166},"Trustworthy email guidance on authentication and filtering helps limit phishing, though hijacked internal accounts need detection too.","Account management with monitoring of unusual sending patterns helps detect hijacked accounts used for scam emails.","Access control management, including MFA, makes harvested university credentials far less useful to attackers.","Incident response management helps the university quickly lock hijacked accounts and warn students.","Malicious content protection can block phishing pages and links before they harvest credentials.","Awareness training teaches students that offers from university accounts may be fraudulent if they ask for upfront payments.","Authenticator management with MFA would stop stolen passwords alone from granting access to university mail.","Awareness training helps students and staff recognise phishing forms hosted on legitimate platforms and fake job offers.","Security and incident management practices support rapid response to compromised accounts used in scams.","Controlling administrative privileges limits what attackers can do with a hijacked university account.","Universities holding EU student data must apply appropriate security, including MFA against credential phishing."]