Loading story…
West African fraud actors targeted U.S. universities with credential-phishing emails posing as account-deactivation notices, harvesting credentials and personal information through third-party form services. They then used compromised .edu accounts to send credible-looking job and internship offers to students, staff, alumni, and external recipients, exploiting institutional trust to support an advance-fee fraud scheme.
Victims who responded received fraudulent checks, often for about $1,000, and were told to deposit them, retain a portion as wages, and send the remaining funds through gift cards or other payments. Operators escalated pressure through calls, texts, threats, and one reported impersonation of an FBI agent. Proofpoint linked observed activity to Nigerian mobile networks through tracking telemetry, while cautioning that infrastructure-based attribution can be obscured; enforcing MFA would disrupt the observed phishing-to-account-takeover chain because the campaign did not use techniques designed to bypass MFA.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Proofpoint used tracking links in direct engagements and observed every investigated operator accessing them from Nigeria; related reporting described Nigerian mobile-network activity. The company assessed the university-targeting advance-fee fraud as linked to Nigerian operations while noting that infrastructure attribution can be obscured.
During engagements with Proofpoint researchers, the fraudsters escalated through repeated calls and text messages when payment was refused. In one case, an operator impersonated an FBI agent identified as “Agent Dozier Jr.” and threatened arrest or legal action.
The actors used hijacked .edu accounts to send credible-looking fake job and internship offers to university communities and external recipients. Targets who engaged were sent fraudulent checks averaging about $1,000 and pressured to send gift-card codes or alternate payments after depositing the checks.
Threat actors targeted U.S. university students, staff, and alumni with account-deactivation phishing lures, directing victims to credential- and PII-harvesting forms on legitimate third-party services. Stolen credentials were used to take over university email accounts where MFA was not enabled.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals identified as 'payroll pirates' have launched a targeted phishing campaign against US universities, aiming to divert salary payments from employees to accounts under their control. Microsoft Threat Intelligence reported that since March 2025, at least 11 accounts across three universities were successfully compromised, with phishing emails sent to nearly 6,000 recipients at 25 different universities. The attackers primarily targeted third-party platforms such as Workday, which are commonly used for HR and payroll management in higher education institutions. The phishing emails often contained malicious links and were crafted to steal multifactor authentication (MFA) codes, enabling the attackers to bypass security measures and hijack employee accounts. Once inside a compromised account, the threat actors established inbox rules to automatically delete warning emails from Workday, thereby concealing unauthorized changes to bank account information. This allowed the attackers to redirect salary payments without immediate detection by the victims. The phishing lures were varied, with some emails referencing COVID-19 exposure or faculty misconduct, and often included links to Google Docs to increase credibility. In one instance, a phishing email about illness exposure was sent to 500 individuals at a single organization. Microsoft attributed the campaign to a group it tracks as Storm-2657 and has proactively contacted affected customers with mitigation advice. The campaign demonstrates a sophisticated understanding of university HR processes and leverages social engineering themes relevant to academic environments. The attackers' use of MFA code theft highlights the evolving tactics used to bypass common security controls. Microsoft emphasized that while Workday was a primary target, other HR and payment systems could also be at risk. The scale of the campaign, with thousands of potential victims, underscores the need for heightened vigilance and improved security awareness among university staff. The incident has raised concerns about the security of third-party platforms used for payroll and HR functions in the education sector. Workday, the platform most frequently targeted, did not respond to requests for comment regarding the incident. Microsoft’s response included sharing technical indicators and recommended best practices to help organizations defend against similar attacks. The campaign is ongoing, and universities are urged to review their security protocols, especially around MFA and email filtering. The incident highlights the persistent threat of phishing and the importance of layered security defenses in protecting sensitive financial information.
Jun 29, 2026
A coordinated phishing campaign targeted at least 18 American universities over several months used the open-source Evilginx phishing kit to bypass multi-factor authentication (MFA) and compromise student and staff accounts. Attackers employed adversary-in-the-middle (AiTM) tactics, leveraging personalized emails with short-lived TinyURLs that mimicked university single sign-on (SSO) portals. By capturing both credentials and session cookies, the attackers were able to fully take over accounts, despite MFA protections. The campaign demonstrated advanced operational security, including frequent changes to attack links and the use of services like Cloudflare to obscure infrastructure, as detailed in Infoblox's investigation. Separately, Harvard University experienced a breach of its Alumni Affairs and Development office systems, attributed to a successful mobile phishing ("mishing") attack. The attacker gained access to internal systems, which the university subsequently secured. This incident highlights the growing trend of mobile-first phishing strategies that bypass traditional desktop and network defenses, posing significant risks to organizations with distributed workforces and sensitive data. The breach underscores the need for dedicated mobile threat defense solutions, as standard MDM and UEM tools are insufficient against sophisticated mobile phishing attacks.
Jun 29, 2026
Unknown cyber actors targeted a US renewable energy company in a spear-phishing campaign that impersonated a US-based financial institution and promised access to more than **$62 million** in funding. The phishing email used a fraudulent loan theme, spoofed financial and government-linked entities through registered domains, email subjects, and attached PDFs, and directed the recipient to download a fake Windows banking application from `secureportal[.]online`. Supporting lures included a document spoofing the UK National Crime Agency and another appearing to contain **SWIFT** information, indicating an effort to build credibility across multiple institutions. The FBI, in coordination with **DHS-CISA**, said the malicious executable contacted `secureportal[.]online` and warned that the activity matched a broader campaign active since at least 2017. Additional reporting linked the infrastructure to numerous lookalike domains, fake login portals, and backdoored installers masquerading as banks in multiple regions; the installers were reportedly built with the open-source **Squirrel** framework and likely delivered TeamViewer-derived remote access trojans with low antivirus detection. Authorities recommended updated anti-malware, application control, reduced administrator privileges, and careful verification of unsolicited emails, attachments, and web addresses.
Aug 15, 2026