Schools in Session: Surge in Phishing Attacks Targeting the Education Sector

KnowBe4 Threat Lab observed a large-scale phishing campaign against the education sector that used QR codes, embedded links, and Google Forms to harvest credentials; over a 30-day period 4,361 threats were reported from 40 sender domains (26 compromised educational institution IDs), many of which bypassed Exchange Online Protection. The report details delivery vectors (plain links, attachments with embedded links, PDFs with QR codes), campaign characteristics, impact risks (credential compromise and subsequent phishing/data loss), and recommends security awareness training, email security enhancements, and ongoing monitoring.