Stolen School Accounts Spread Phishing Between Districts

Attackers are taking over K-12 staff accounts and using them to send convincing phishing messages to people in other school districts. Because the messages come from real accounts through authenticated email systems, parents and school employees may have a harder time recognizing the danger.

What happened

The Multi-State Information Sharing and Analysis Center warned 808 of its 6,116 K-12 member organizations that staff accounts or credentials had appeared on underground marketplaces during the last school year, according to Help Net Security.

Investigators found that attackers can phish one legitimate district account and then use it to contact staff in other districts. The Center for Internet Security, which operates MS-ISAC, calls this “account takeover hopping” and expects the activity to continue during the current school year. Attackers have also impersonated superintendents through hijacked accounts to commit fraud.

Email is not the only route. Help Net Security reported that 1,159 of 1,796 infections involving the 10 malware families most commonly seen among member schools were traced to malicious advertisements on legitimate websites. Analysts also recorded 285 ClickFix incidents, in which a webpage persuaded someone to run malicious commands on a computer.

Who is affected

School employees are the direct targets, but families may receive messages sent from compromised teacher, administrator or district accounts. A familiar sender address does not prove that a request, attachment or link is safe.

The report does not identify individual affected districts or disclose whether student or parent records were exposed. In a survey of 426 school IT and security workers, 51% said their district had experienced a cyber incident in the previous 12 months. Twenty-two percent reported interrupted classroom instruction, while 2% reported school closures.

What to do now

1. Verify unusual school requests another way. If an email asks for money, passwords, files or urgent action, open the district’s official website and call a published number. Do not use contact details contained in the suspicious message.

2. Inspect links before opening them. On a computer, hover over a link to view its destination. On a phone, press and hold it to preview the address. Avoid signing in through unexpected links, even when the message came from a known school account.

3. Do not run commands suggested by a webpage. Close any page that tells you to open PowerShell, Command Prompt, Terminal or a Run box and paste text to fix a browser or document problem. Report the page to the school’s technology office if it appeared on a school-managed device.

4. Report suspicious school email. Use your email service’s Report phishing or Report spam option, then forward the details to the district’s published technology or security contact. A quick report may help the district warn other families.

5. Strengthen accounts used for school communication. Turn on multifactor authentication in the account’s Security or Sign-in settings when available, and use a unique password. CIS recommends that districts expand MFA and monitor exposed credentials.

6. Update personal devices used for schoolwork. Open the operating system and browser update settings, install available updates, and restart. Families can also follow the weekend protection guide to review accounts and devices together.