Cybercriminals are compromising US university email accounts and using them to distribute job-related advance fee fraud, according to research from Proofpoint.<\/p>\n\n\n\n
The company’s researchers are tracking a cluster of activity attributed to West African fraud actors that combines credential phishing, account takeover and subsequent financial fraud.<\/p>\n\n\n\n
Attacks typically begin with emails asking recipients to verify or refresh their passwords, sometimes warning that accounts could be deactivated because of retirement, graduation or transfer.<\/p>\n\n\n\n
Victims are directed to forms hosted on legitimate services including Google Forms, Wix, Jotform, Zoho Forms and Microsoft Office rather than conventional phishing websites.<\/p>\n\n\n\n
The forms request information including usernames, passwords and personally identifiable information, which can then be used to compromise university accounts.<\/p>\n\n\n\n
Attackers subsequently use trusted .edu accounts to distribute fraudulent job or internship opportunities. These ultimately lead to advance fee fraud, demonstrating what Proofpoint describes as multi-stage monetisation rather than isolated scam activity.<\/p>\n\n\n\n
Students can be particularly attractive targets because of financial pressures and their potential trust in communications originating from institutional email accounts.<\/p>\n\n\n\n
Proofpoint said university accounts also provide attackers with credibility when targeting people both inside and outside an institution.<\/p>\n\n\n\n
The findings demonstrate how an initial credential theft campaign can develop into further attacks by exploiting the reputation and contacts associated with a compromised university identity.<\/p>\n","protected":false},"excerpt":{"rendered":"
Cybercriminals are compromising US university email accounts and using them to distribute job-related advance fee fraud, according to research from Proofpoint. The company’s researchers are tracking a cluster of activity attributed to West African fraud actors that combines credential phishing, account takeover and subsequent financial fraud. Attacks typically begin with emails asking recipients to verify […]<\/p>\n","protected":false},"author":18,"featured_media":1016,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[694,4,51],"tags":[288,78,290,813,567,128,814,815],"class_list":["post-1015","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-africa","category-data","category-top-stories","tag-account-takeover","tag-cybersecurity","tag-email-security","tag-fraud","tag-higher-education","tag-phishing","tag-proofpoint","tag-universities"],"acf":[],"publishpress_future_action":{"enabled":false,"date":"2026-10-26 00:13:47","action":"change-status","newStatus":"draft","terms":[],"taxonomy":"category","extraData":[]},"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/posts\/1015","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/users\/18"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/comments?post=1015"}],"version-history":[{"count":0,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/posts\/1015\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/media\/1016"}],"wp:attachment":[{"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/media?parent=1015"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/categories?post=1015"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/tags?post=1015"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}