Education Sector Faces Back-to-School Phishing and Malware Surge

The education sector has become the most targeted industry for cyberattacks globally, with Check Point reporting that schools, colleges, universities, and research institutions averaged 4,696 weekly attacks from January through July 2026—well above the cross-industry average and up 8% year over year. Researchers said attacker activity is intensifying ahead of the academic term, with 18,954 newly registered education-related domains observed in July and the share flagged as malicious worsening from 1 in 305 in June to 1 in 226 in July. Regional pressure was strongest in APAC by attack volume, while Europe and Latin America saw notable growth.

Threat actors are using education-themed phishing, credential theft, and malware delivery to exploit routine school workflows and trusted brands. Observed lures included fake student discount and reward sites, spoofed education and government portals, and malicious PDFs that redirected victims to counterfeit Microsoft 365 and OneDrive login pages designed to harvest credentials. Researchers also identified malware distribution through a compromised school website in Bangladesh, underscoring how attackers are combining fraudulent domains with abused legitimate infrastructure to target students, staff, and institutions for account compromise and theft of personal and financial data.