Hackers Use Hijacked University Emails to Scam Students, Pose as FBI Agent

Proofpoint uncovered a campaign in which attackers compromise university email accounts and send credential-harvesting forms (hosted on legitimate platforms) and fraudulent job offers; stolen credentials are used for account takeover and to run advance-fee/gift-card scams (including FBI impersonation). Researchers traced activity to Nigerian mobile networks and recommend enforcing MFA and verifying unexpected job offers to prevent fraud.