chat
expand_more

University Students Targeted by Credential Phishing Campaign

With school starting this month, cybercriminals are back in action—targeting university students in an attempt to steal valuable personal information. In a recent attack uncovered by Abnormal, a credential phishing attacker used a legitimate email account and created false urgency to steal student credentials through a phishing website.
August 12, 2021

With school starting this month, cybercriminals are back in action—targeting university students in an attempt to steal valuable personal information. In a recent attack uncovered by Abnormal, a credential phishing attacker used a legitimate email account and created false urgency to steal student credentials through a phishing website.

Summary of Attack Target

  • Platform: Google Workspace
  • Target: University Students
  • Payload: Phishing Link with Urgent Message
  • Technique: Credential Theft

About the Credential Phishing Attack

University credential phishing email 1024x685

The subject line displays a sense of urgency, with keywords including important and multiple exclamation marks. The body of the message explains that the recipient needs to update their account due to recent security incidents, and provides a link to re-secure the account. As an added threat, the text states that the account will be locked if not verified within 48 hours.

While there are some significant grammatical errors that may make a conscientious student question the legitimacy of the email, they are not so obvious that all students would recognize them. Furthermore, students in a hurry may only skim the body of the email before clicking the link to verify, and those new students who are eager to keep account access may submit their information without verifying the authenticity of the email.

Within the email, a dummy link with a variation of a forms.office.com address is provided, which redirects the recipient to the phishing page. In this particular attack, that redirect link was removed, and students who click on it are taken here.

University credential phishing website error 1024x633

However, those students who instead clicked on the “Click” or “URL” links in the body of the email were taken to the actual phishing website shown here.

University credential phishing payload 1024x642

This phishing page asks for not only the full name and email address of the student, but also their student ID number and their email password. Once the cybercriminal has this information, they would be able to access multiple other university services, and could potentially uncover additional personal information like addresses, financial information, and social security numbers.

Why It Bypassed Existing Security Infrastructure

Many security tools on the market are not equipped to identify suspicious behavior from a legitimate organization using legitimate email addresses. Abnormal Security prevented this attack by recognizing the specific language and content of the email, and detecting the likely compromise of the sender’s email address.

Specific signals that Abnormal noticed were the urgent language commonly observed in phishing attacks, the detection of a link that redirects the recipient to a different webpage, and the low frequency of sending behavior between the sender and recipients.

University credential phishing analysis 1024x648

In this case, Abnormal was able to detect the email within seconds and remove it from customer inboxes, ensuring that no Abnormal customer entered their credentials into the malicious website. Without this added layer of security, recipients would’ve been put at risk, and cybercriminals may have gained access to entire systems through the stolen credentials. That said, it should be noted that this exact email, as well similar attacks, may have been received by universities that do not use Abnormal Security.

While this attack was unique to a specific university and spoofed its own email domain, schools everywhere should be aware of this tactic and seek to prevent it, particularly as students return this August.

Interested in seeing how Abnormal can prevent credential phishing at your organization? See the product in action by requesting a demo.

University Students Targeted by Credential Phishing Campaign

See Abnormal in Action

Get a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

 

See the Abnormal Solution to the Email Security Problem

Protect your organization from the full spectrum of email attacks with Abnormal.

 
Integrates Insights Reporting 09 08 22

Related Posts

B Most Interesting Attacks Q1 2024
Take a look at five of the most unique and sophisticated email attacks recently detected and stopped by Abnormal.
Read More
B MKT499 Images for Customer Blog Series
Discover key industry trends and insights from cybersecurity leader Michael Marassa, CTO of New Trier Township High School District 203.
Read More
B Construction Professional Services QR Code Attacks
Abnormal data shows construction firms and professional service providers are up to 19.2 times and 18.5 times, respectively, more likely to receive QR code attacks than organizations in other industries.
Read More
B 1500x1500 Evolving Abnormal R2
From the beginning, we created Abnormal Security to be a generational company that protects people from cybercrime. Here’s how we’re doing it.
Read More
Blog Cover 1500x1500 Images for SOC Time Blog
Discover the critical tasks that occupy SOC analysts’ schedules beyond mere inbox management, and discover insights into optimizing efficiency in cybersecurity operations.
Read More
B 1500x1500 MKT494 Top Women in Cybersecurity
In honor of Women's History Month, we're spotlighting 10 women leaders who are making invaluable contributions to cybersecurity.
Read More