Loading story…
The education sector has become the most targeted industry for cyberattacks globally, with Check Point reporting that schools, colleges, universities, and research institutions averaged 4,696 weekly attacks from January through July 2026—well above the cross-industry average and up 8% year over year. Researchers said attacker activity is intensifying ahead of the academic term, with 18,954 newly registered education-related domains observed in July and the share flagged as malicious worsening from 1 in 305 in June to 1 in 226 in July. Regional pressure was strongest in APAC by attack volume, while Europe and Latin America saw notable growth.
Threat actors are using education-themed phishing, credential theft, and malware delivery to exploit routine school workflows and trusted brands. Observed lures included fake student discount and reward sites, spoofed education and government portals, and malicious PDFs that redirected victims to counterfeit Microsoft 365 and OneDrive login pages designed to harvest credentials. Researchers also identified malware distribution through a compromised school website in Bangladesh, underscoring how attackers are combining fraudulent domains with abused legitimate infrastructure to target students, staff, and institutions for account compromise and theft of personal and financial data.
See the actors and campaigns active against you right now.
10 events from the most recent confirmed update back to the earliest known activity.
In July 2026, the proportion of newly registered education-related domains flagged as malicious worsened to one in every 226. Check Point assessed this as part of a seasonal back-to-school buildup in attacker infrastructure.
Researchers identified 18,954 newly registered education-themed domains in July 2026, up 5% month over month and 3% year over year. Examples included deceptive domains such as education-gov[.]com, students-portal[.]com, and checkmyschool[.]org.
In July 2026, weekly attacks against education organizations climbed to 4,848. The July figure represented a 14% year-over-year increase, with APAC posting the highest regional volume and Europe and Latin America showing notable growth.
Check Point ThreatCloud data showed that in June 2026, one in every 305 newly registered education-related domains was flagged as malicious. This established the baseline before a worse ratio was observed the following month.
During summer 2026, multiple Vermont school districts, including Slate Valley Unified Union School District and Orleans Central Supervisory Union, were targeted by a credential-phishing campaign using trusted real email accounts and an "excel secure portal" lure. Officials said the malicious link triggered scripts that read and deleted emails and sent further phishing messages, but they found no evidence of student or staff data theft or monetary loss.
Researchers identified a coordinated registration campaign of 10 student loan-themed domains following the studentloansYYYY.com pattern for 2026 through 2035, along with a network of 48 bootcamp-student domains. The registrations were assessed as evidence of large-scale automated activity targeting students and prospective learners.
Check Point reported that education became the most targeted industry worldwide in 2026. Between January and July 2026, education organizations averaged 4,696 weekly attacks per organization, ranking first among 23 tracked sectors and exceeding both the cross-industry average and government sector volumes.
Researchers identified a malicious URL at cambrianschoolbd[.]com/mail/ hosted on the compromised website of Bangladesh’s Cambrian School. Threat intelligence sources flagged the URL as an information-stealer and malware distribution point, and the site had previously displayed a fake Spotify-branded CAPTCHA linked to malware delivery or evasion.
Researchers uncovered malicious PDF campaigns, including files named globeschool.pdf and beths-grammar-school.pdf, that impersonated specific schools. The PDFs routed victims through compromised websites to counterfeit Microsoft 365 and OneDrive login pages designed to harvest credentials.
Researchers documented an active phishing scheme using studentdiscount[.]online that impersonated a Target student rewards promotion. The lure promised a fake $750 reward and redirected victims to fraudulent offers and gambling-related content.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
5 references tracked. Mallory keeps watching after this page renders.
vtdigger.org
Open sourceitsecurityguru.org
Open sourceitsecurityguru.org
Open sourceblog.checkpoint.com
Open sourceresearch.checkpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are launching thousands of education-themed fraudulent websites and phishing campaigns ahead of the 2026 academic year, impersonating school-related services to steal personal and financial information from students, parents, and educators. The activity exploits back-to-school processes and the heightened volume of education-related communications during enrollment and term preparation. Check Point Research reported that educational organizations sustained an average of **4,696 cyberattacks per organization per week** from January through July 2026—an 8% increase from the comparable 2025 period and more than double the **2,150** weekly cross-industry average. Education is therefore the most targeted sector globally, requiring schools and families to verify school portals and payment requests before submitting credentials or financial data.
Aug 30, 2026
U.S. authorities warned that malicious cyber actors were actively targeting K-12 schools and other educational institutions as remote learning expanded, using ransomware, malware, phishing, DDoS attacks, and video-conference intrusions to disrupt classes and steal sensitive data. The joint FBI, CISA, and MS-ISAC advisory said schools had become targets of opportunity, with ransomware incidents rising sharply and commonly involving **data theft and extortion**; families observed in attacks included `Ryuk`, `Maze`, `Nefilim`, `AKO`, and `Sodinokibi/REvil`, while malware such as `ZeuS` and `Shlayer` also affected the sector. Separate reporting on criminal forums showed underground sellers offering remote access to compromised schools and universities in the U.S., U.K., Australia, Israel, and Germany, with listings priced from **$200 to $17,000** based on victim size and privilege level. The activity coincided with leaked credentials, exposed FTP servers, and student-data incidents tied to education and e-learning platforms, reinforcing concerns about weak remote-access security, exposed `RDP` and `SMB` services, end-of-life software, and third-party edtech risks; officials urged patching, MFA, network segmentation, offline backups, DDoS protections, tighter conferencing controls, and stronger vetting of service providers.
Aug 15, 2026
The UK Department for Education confirmed a cyber attack after a previously unknown group, **ExfilSquad**, claimed it had stolen about **607,000 records** from the department’s Help Desk Self-Service Portal and Turing Scheme Portal. The exposed data reportedly included names, email addresses, telephone numbers, and job titles linked to parents, school leaders, university staff, and government officials. The attackers allegedly sought to extort the department by threatening to publish the data rather than encrypt systems, indicating a **data-theft-and-extortion** operation. The department said it had contained the incident and was working with the **National Cyber Security Centre** and **National Crime Agency** on the investigation. The breach lands amid persistent cyber pressure across UK education, where the government’s 2025/2026 breaches survey found incidents were identified by **49% of primary schools**, **73% of secondary schools**, **88% of further education colleges**, and **98% of higher education institutions**. **Phishing** remained the most common threat, while further and higher education institutions reported broader exposure to impersonation, malware, denial-of-service, and unauthorized access, along with greater operational impact. The survey said education institutions generally maintain stronger governance and technical controls than businesses, but weaknesses in **supply-chain security** and **patch management**, combined with budget and staffing constraints and rising concern over **AI-enabled social engineering**, continue to leave the sector exposed.
Aug 11, 2026