Phishing Frenzy: American Universities Under Siege by Sneaky Hackers
Infoblox reveals that 18 universities fell prey to a cunning phishing attack that bypassed Multi-Factor Authentication using the Evilginx tool. This digital mischief stole login details by impersonating university portals, proving once again that cybercriminals have more tricks up their sleeves than a magician at a rabbit convention.
Hot Take:
Who needs a degree in computer science when you can just hack the whole university? Cybercriminals are clearly winning the school attendance award with this prolonged phishing attack. Kudos to the hackers for mastering the art of being the digital schoolyard bullies!
Key Points:
- Eighteen American universities were targeted in a coordinated phishing attack.
- The attack ran from April to November 2025, bypassing Multi-Factor Authentication (MFA).
- Hackers used an open-source phishing kit, Evilginx, to steal login details and session cookies.
- The attack used temporary TinyURLs mimicking university portals, and masked server locations with Cloudflare.
- Nearly 70 domains were involved, with the University of San Diego hit first on April 12, 2025.
Already a member? Log in here