Fake Title IX Claims Push Zoho Assist RAT

A real phishing campaign is using fabricated sexual misconduct (Title IX-style) allegations to pressure university staff into clicking a link and installing Zoho Assist, a legitimate remote-access tool being abused as malware. The emails impersonate university leaders and route victims through a Google Drive link to hide the final download. The goal is remote control of the victim’s computer, potentially leading to data theft and broader compromise.

Key findings

• Attackers impersonate university presidents/deans and send emails alleging a sexual misconduct violation to trigger urgency and fear.
• The campaign uses a Google Drive link as an intermediate step to help evade email security controls before delivering the final payload.
• The payload is an abused but legitimate remote-access tool (Zoho Assist) that can give attackers full interactive access to the victim’s computer.
• Targets appear heavily concentrated in healthcare-affiliated universities (medical colleges/teaching hospitals), raising critical-infrastructure and compliance concerns.
• Emails are designed to look official by spoofing letterhead, signature blocks, and even the university domain.

Who’s being targeted

• Commonly targeted roles: Higher education administration, Medical school/teaching hospital staff, Title IX / Student Affairs, HR, Legal/Compliance, All staff who handle external university partnerships.
• Affected industries: Higher Education, Universities and Colleges, Healthcare, Teaching Hospitals/Medical Colleges, Public Health.
• Attack channels: email, website.
• Impersonated: Partner university president/dean (university leadership).

Awareness takeaways

• Treat emotionally charged or high-stakes allegations (e.g., misconduct claims) as a common manipulation tactic, pause and verify through a trusted channel before clicking anything.
• Be suspicious when an email says a ‘document’ requires installing new software; stop and confirm with IT/security before installing any tool.
• Watch for multi-hop link chains (email link → Google Drive → second link → download). These are often used to evade security filters.
• Verify cross-organization requests through legal/compliance using known contact information, especially when the email appears to come from a partner institution’s leadership.

Red flags to watch for

• External message impersonates senior leadership and leverages an emotionally charged allegation to rush action
• Link goes to Google Drive first, then to a second download location (multi-hop link chain)
• Message instructs the user to install a program (Zoho Assist) rather than view a document