Abnormal Security highlights the case of university students targeted by credential phishing attack

With school starting this month, cybercriminals are back in action, targeting university students in an attempt to steal valuable personal information. In a recent attack, uncovered by Abnormal Security, a credential phishing attacker used a legitimate email account and created false urgency, in order to steal student credentials, through a phishing website.

Credential phishing attack

In this attack, cybercriminals used the real university email of a person on the ‘Student Services Team’ to target students. While it’s unclear how the email address was originally compromised, Abnormal Security determined that this attack came from a real person at the university, using their real email address, making it especially difficult for unsuspecting students to spot.

The subject line displays a sense of urgency, with keywords, including important and multiple exclamation marks

The subject line displays a sense of urgency, with keywords, including important and multiple exclamation marks. The body of the message explains that the recipient needs to update their account, due to recent security incidents and provides a link to re-secure the account. As an added threat, the text states that the account will be locked, if not verified within 48 hours.

Pointers highlighting fraudulent email

While there are some significant grammatical errors that may make a conscientious student question the legitimacy of the email, they are not so obvious that all students would recognise them. Furthermore, students in a hurry may only skim the body of the email, before clicking the link to verify and those new students, who are eager to keep account access, may submit their information, without verifying the authenticity of the email.

Within the email, a dummy link with a variation of a forms.office.com address is provided, which re-directs the recipient to the phishing page. In this particular attack, that redirect link was removed, and students who click on it are taken here.

Targeting unsuspecting students

However, those students who instead clicked on the ‘Click’ or ‘URL’ links, in the body of the email, were taken to the actual phishing website.

This phishing page asks for not only the full name and email address of the student, but also their student ID number and their email password. Once the cybercriminal has this information, they would be able to access multiple other university services and could potentially uncover additional personal information, such as addresses, financial information and social security numbers.

Bypassed existing security infrastructure

Specific signals that Abnormal Security noticed were the urgent language, commonly observed in phishing attacks

Many security tools on the market are not equipped to identify suspicious behaviour, from a legitimate organisation using legitimate email addresses. Abnormal Security prevented this attack, by recognising the specific language and content of the email, and detecting the likely compromise of the sender’s email address.

Specific signals that Abnormal Security noticed were the urgent language, which is commonly observed in phishing attacks, the detection of a link that re-directs the recipient to a different webpage and the low frequency of sending behaviour between the sender and recipients.

Abnormal Security detects malicious emails

In this case, Abnormal Security was able to detect the email within seconds and remove it from customer inboxes, ensuring that no customer entered their credentials into the malicious website. Without this added layer of security, recipients would’ve been put at risk and cybercriminals may have gained access to entire systems, through the stolen credentials.

That said, it should be noted that this exact email, as well as similar attacks, may have been received by universities that do not use Abnormal Security solutions. While this attack was unique to a specific university and spoofed its own email domain, schools everywhere should be aware of this tactic, and seek to prevent it, particularly as students return this August.

Summary of attack:

• Platform: Google Workspace
• Targets: University Students
• Payload: Phishing Link with Urgent Message
• Technique: Credential Theft