[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fF_6_Z73Bz6HdnBAr4XCPnM9ffhz0UmN73cmQktoVVUU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"c72bca11-26ff-443c-b593-afea7b1f30da","stolen-credentials-linked-to-school-bomb-threats-highlight-infostealer-risk","ec5a8278-9edc-4d19-9fd3-8b30b427da06","Stolen Credentials Linked to School Bomb Threats Highlight Infostealer Risk","Two university email accounts used to send bomb threats to over 6,000 Italian schools were already present in infostealer-harvested credential dumps, meaning the accounts had been compromised before the threats were even sent. This incident illustrates how stolen credentials can sit in criminal markets for extended periods, enabling malicious actors to abuse legitimate institutional accounts for high-impact activities like mass threat campaigns. The use of a real university email address lends false legitimacy to such threats and complicates attribution. Organizations that fail to monitor for credential exposure and enforce strong account hygiene leave their users — and third parties — vulnerable to downstream abuse of compromised identities.","**Immediate actions:**\n- Subscribe to a credential exposure monitoring service (e.g., Have I Been Pwned, SpyCloud) and immediately reset passwords for any accounts found in breach data.\n- Force password resets and invalidate active sessions for all accounts confirmed in infostealer dumps.\n\n**Long-term improvements:**\n- Enforce multi-factor authentication (MFA) on all institutional email accounts so that stolen passwords alone are insufficient for account access.\n- Establish a formal process for continuously monitoring dark web and infostealer data sources for institutional email credentials.\n- Implement account anomaly detection to flag unusual login locations, times, or bulk email sending behavior.\n\n**Detection measures:**\n- Integrate email gateway logging with a SIEM to alert on sudden spikes in outbound email volume from individual accounts.\n- Conduct regular audits of email account activity to identify dormant or suspicious accounts that may have been silently compromised.",[12,13,14,15,16],"MITRE ATT&CK T1078: Valid Accounts","CIS Control 6: Access Control Management (v8)","NIST SP 800-53 SI-4: System Monitoring","NIS2 Article 21(2)(j)","ISO\u002FIEC 27001:2022 A.5.17: Authentication information",{"NIS2 Article 21(2)(j)":18,"MITRE ATT&CK T1078: Valid Accounts":19,"NIST SP 800-53 SI-4: System Monitoring":20,"CIS Control 6: Access Control Management (v8)":21,"ISO\u002FIEC 27001:2022 A.5.17: Authentication information":22},"This point explicitly requires the use of multi-factor authentication and secured communications, which, if applied to institutional email accounts, would have prevented stolen passwords alone from being used to send the threats.","The threat actors leveraged credentials already present in stolen infostealer data to abuse legitimate university email accounts, which is precisely what this technique describes — using valid credentials to gain or maintain access.","SI-4 requires monitoring information systems for anomalous activity; detecting the bulk-sending of threatening emails from two accounts would have been possible with outbound email anomaly monitoring.","CIS Control 6 requires managing and enforcing access credentials including password policies and MFA; enforcing MFA on the compromised university accounts would have prevented the stolen passwords from being sufficient to send the threats.","This control requires secure management of authentication information including monitoring for compromised credentials, which would have prompted a reset of the exposed university email passwords before they could be abused.","published","2026-11-13T00:20:55.066761+00:00","2026-11-13T00:20:55.052+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fsecurityaffairs.com\u002F202941\u002Fsecurity\u002Fthe-school-bomb-threats-came-from-accounts-already-in-stolen-data.html","the-school-bomb-threats-came-from-accounts-already-in-stolen-data-a14cc5","The School Bomb Threats Came From Accounts Already in Stolen Data",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":50,"name":51,"problem":52},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",{"slug":54,"name":55,"problem":56},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]