Three Ways Cybercriminals Are Targeting Education: Credential Theft, Remote Access and Money Mules

1 September 2026

By Hiwot Mendahun and the Mimecast Threat Research Team

Threat Overview

Education institutions face threats extending beyond conventional password phishing. Recent Mimecast investigations identified three campaigns pursuing different objectives: employee account takeover, remote-access deployment and the potential recruitment of students into fraudulent financial activity.

Although the campaigns are not necessarily connected, each exploits familiar education-sector workflows. These include student-record compliance notices, transcript submissions and flexible employment opportunities.

Campaign One: Compliance Notice Harvests University Credentials

Campaign Overview

The first campaign targets just over 300 employees across 4 universities in the U.S. with a message impersonating the Office of Student Records and Privacy Compliance at multiple education institutes.

Recipients are told that a student record associated with their account may have been accessed or disclosed without authorization. The message cites federal law, requests preservation of relevant records and warns that failure to complete a required acknowledgment could result in administrative action.

The language creates urgency while avoiding a direct accusation, encouraging the employee to open the supposedly secure portal before independently verifying the notice.

Campaign Flow

1. The employee receives an alleged student-privacy compliance notice.
2. The link opens an attacker-controlled Microsoft collaboration page hosted on Vercel.
3. A supposedly shared document prompts the employee to sign in.
4. The fake login captures input in real time.
5. The operator can direct the victim through password, Duo or Microsoft Authenticator prompts.

Technical Analysis

Observed Vercel deployments included:

• ms-secure-sign-hh0nnqz[.]vercel[.]app
• ms-secure-sign-s22xus[.]vercel[.]app

The phishing application used several same-origin endpoints:

• POST /alert notified the operator when a victim began entering an address.
• POST /api/keystroke transmitted field contents while they were being typed.
• POST /auth sent the completed email address, password and any additional authentication information.

The frontend rejected common personal email domains and instructed victims to use a work or school account. After receiving a password, it polled /auth every second for operator-controlled instructions.

Supported responses included incorrect-password prompts, Duo Push, Duo passcodes, phone calls, Microsoft Authenticator number matching and arbitrary custom questions. This demonstrates an operator-in-the-loop workflow designed to collect more than a static username and password.

Compromising a university employee account could expose student records, institutional email and cloud documents. It could also give the attacker a trusted mailbox for follow-on phishing against students and colleagues.

Campaign Two: Transcript Lure Delivers ScreenConnect

Campaign Overview

The second campaign of over 400 emails sent to 60 universities in the U.S. primarily targets admissions departments or shared mailboxes with an alleged transcript request for students coming from a number of educational institutes.

The message asks the registrar to review transcript status and submission details. The timing and subject matter make the request plausible for staff processing increased admissions and enrolment activity.

CAPTCHA-Gated Delivery

The campaign uses a tokenized URL on a likely compromised WordPress website:

Tokenized /redirect/ URL

→ Google reCAPTCHA

→ server verifies the CAPTCHA

→ redirect_control_session is approved

→ HTTP 302 redirect to transcriptt.php

→ PHP returns [name] Transcript.vbs

The session cookie and CAPTCHA prevent the payload from being returned immediately to automated scanners. Successful verification results in:

Content-Disposition: attachment;

filename="First Name Last Name Transcript.vbs"

Following on from opening the VBS file the recipient is informed that an MSI would be downloaded and required confirmation. It then launched the installer normally and displayed an Unknown Publisher UAC warning.

Observed ScreenConnect sources included:

• invitee[.]click
• invite[.]surf

The installer parameters specified a ScreenConnect Access session. If installation succeeds, the operator could potentially obtain persistent remote access and use it for credential theft, data access, lateral movement or additional payload deployment.

This is not a drive-by compromise: the recipient must download and run the VBS, and some variants require further approval. The transcript naming and generic MSI filename are intended to disguise the remote-access deployment.

Campaign Three: Student Job Offers Show Money-Mule Indicators

Campaign Overview

The third campaign targeted a large number of students across a number of universities advertising flexible remote employment.

The campaigns contained no content in the body but had a word attachment which contained information about the position and a link

Selecting ‘Apply Here’ led through a Google Slides presentation to a Google Form.

Observed campaigns would ask applicants whether they had a bank account or credit card, requested the name of their bank, and instructed them to send a text message to phone number once form was complete.

The form stated that the applicant’s first task would involve distributing donations according to instructions from a supposed programme coordinator. Combined with the questions about bank access and check-deposit procedures, this is consistent with the early stages of a fake-check scam or money-mule recruitment operation.

The evidence collected so far does not prove that funds were transferred. However, the workflow closely matches warnings published by the FBI and FTC. In these schemes, students receive counterfeit checks, deposit them into personal accounts and are instructed to transfer some of the apparent funds to another person or “vendor.” When the check is identified as fraudulent, the bank removes the funds and the student remains responsible for the money transferred.

Why Students Are Targeted

Students are attractive targets because many seek flexible employment that can fit around study. They may also have limited experience evaluating recruitment processes and can be more receptive to high-paying remote work requiring few hours.

Criminals can exploit institutional branding and trusted services such as Google Docs, Slides and Forms to make the opportunity appear legitimate. Moving the conversation to text messaging also removes the victim from university-monitored communication channels.

Students recruited as money mules may face frozen or closed bank accounts, financial losses and possible legal consequences—even when they did not initially understand the criminal purpose of the transactions.

Recommendations

For Education Institutions

• Warn staff and students about compliance notices, transcript submissions and job offers arriving through unsolicited email.
• Require users to verify requests through known institutional contacts rather than details supplied in the message.
• Detect and investigate script files, unexpected MSI downloads and new ScreenConnect installations.
• Avoid broadly blocking legitimate hosting services; inspect specific hostnames, paths and redirect chains.
• Coordinate fake-job reporting between security teams, careers services and student-support departments.

For Students and Employees

• Inspect the complete hostname before entering credentials.
• Never install software solely to review a transcript or shared document.
• Confirm job opportunities through the institution’s official HR or careers service.
• Do not use a personal bank account to receive or transfer money on behalf of an employer.
• Treat checks issued before work begins, requests to buy equipment from a named vendor and instructions to move funds as fraud indicators.

Conclusion

These campaigns illustrate three different outcomes arising from education-themed social engineering: account takeover, remote-access deployment and financial exploitation.

The approaches differ technically, but each relies on familiarity and timing. Privacy notices pressure employees to act, transcript requests blend into admissions workflows, and flexible job offers appeal to students seeking income. Education institutions should therefore prepare for more than one phishing pattern as academic activity increases.