Hackers Use Hijacked University Emails to Scam Students, Pose as FBI Agent

Threat actors are exploiting weak credential hygiene within university environments by using phishing forms hosted on legitimate platforms to harvest login credentials, then weaponizing those trusted email accounts to distribute fraudulent job offers. Because the emails originate from legitimate university domains, traditional spam filters and recipients alike are far more likely to trust them, amplifying the attack's effectiveness. The scam escalates into advance-fee fraud, with victims manipulated into purchasing gift cards and even facing impersonation of federal law enforcement agents. This attack chain demonstrates how a single compromised credential can cascade into significant financial and reputational harm for both the institution and its students. It underscores the critical need for multi-factor authentication and ongoing phishing awareness education in academic settings.