No Politician Too Small: School Board Candidates Targeted By Phishing and BEC Scams

A targeted BEC and spear‑phishing campaign hit local Colorado school board candidates and extended to nearly 800 organizations across sectors; adversaries used researched social graphs, spoofed document-signing attachments (including campaign logos), dynamically injected target logos, allowed three password attempts, and exfiltrated captured credentials via the Telegram API—demonstrating relatively sophisticated credential-harvesting operations that threaten campaigns, municipalities, and healthcare providers.