Scammers target new students by hijacking legitimate US university emails

Date:
Thu, 01 Oct 2026 17:15:00 +0000

Description:
Scammers are offering students fake jobs and stealing their money

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Stolen .edu accounts spread
fake job offers and gift card scams Victims deposit fake $1,000 checks, then buy scammers gift cards Proofpoint linked operators to Nigeria through IP logging investigations Cybercriminals from Nigeria are targeting college students in the West with an advance fee fraud (AFF) scam tricking them into giving away hundreds of dollars.

Security researchers Proofpoint discovered the campaign, which aims to get gullible students to buy gift cards with their own money and send them to the scammers. We dont know how many people fell victim, or for how long the operation has been going, but Proofpoint believes it knows why the scammers are targeting primarily college students. Latest Videos From TechRadar Watch full video here: What is the scam? Younger students may have less experience with email correspondence and are new to engaging with potential work or money-making opportunities; alumni may still have active email accounts, but may not use them frequently, providing an opportunity for threat actors to hijack their contact lists; and staff and faculty are constantly receiving communications from students, parents, community members, etc. from a variety of personal and university emails, the experts said.

By gaining access to a .edu account, threat actors can use the authority of the TLD to lend credibility to their scams both inside and outside of the target organization. You may like Scammers hijack real Shopify notifications to swindle victims here's how to stay safe North Korean 'Contagious Interview' gang hits 30,000 businesses across the world with malware
following fake interviews Scammers pose as airline customer support to help with your complaints and then steal your credit card info

There are multiple stages to the scam. It starts with a phishing email to anyone with an .edu address, warning the victim that their email account is going to get deactivated because of a made-up excuse like retirement, graduation, or transfer. The lure asks the victim to verify their address,
and while doing so, they are asked to share their passwords, as well.

After gaining access to the account, the crooks use it to share a second phishing email , this time to students in the contacts list, as well as
anyone else with an .edu address. This lure advertises a fake job for the students to apply to. Those that get the job are given a copy of a check for $1,000 and are told to deposit it. They are instructed to keep half as their salary, and to purchase gift cards with the other half, which they should
then send back to the scammers. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news
and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

The checks are, obviously, fake, and by the time the bank discovers the scam, the victim will have already purchased the gift cards and sent them away. The bank then reverses the deposit, leaving the victim $500 short.

Proofpoints researchers were hired for one of these jobs, which is how they uncovered the entire modus operandi. They also learned that if the victim doesnt follow through with the instructions, they will become aggressive, suggesting different payment services, and even call the victim on the phone, pretending to be an FBI agent threatening legal action and arrest. Nigerian operation Attributing the scam to any particular group is rather difficult, the researchers said. They did, however, manage to trick the fraudsters into using Grabify, an IP logging and URL shortening service usually used by
online marketers. What to read next FBI claims fake cop scams are costing victims billions here's what to look out for This North Korean recruitment scam was so convincing it even fooled Google Fake FBI social media scams are on the rise here's what to look out for

The links are used to extract things like device information and IP addresses from whoever clicks them, and Proofpoints researchers found the engagement coming from Nigeria.

While there are ways to hide ones IP address, Proofpoint is rather confident about the location of this particular operation.

While it is possible for threat actors to spoof their infrastructure, based
on our investigations from hundreds of engagements, these AFF fraudsters typically use their real mobile network infrastructure to conduct their crimes. Even if the scammers do use a VPN, they often still click on researchers links from their genuine devices due to the multi-platform communication style they use (and the desire to monetize, despite possible deanonymization), Proofpoint concluded. The best antivirus for all budgets
Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/scammers-target-new-students-by-hijacki ng-legitimate-us-university-emails


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)