Phishing Campaigns Targeting Higher Education Institutions

Beginning in August 2024, Mandiant and Google observed an uptick in phishing campaigns targeting U.S. universities that have run since at least October 2022. Attackers used compromised educational-hosted Google Forms and scraped, re-hosted university login pages to harvest credentials and financial information, timed to academic calendar events (e.g., start of term, financial aid deadlines). At least 15 universities and thousands of users per month were targeted; malicious forms were reported and removed, and campaigns aim at payment redirection and account compromise.