MS-ISAC tracked attackers who used a phished K-12 staff account to send phishing messages to that employee’s contacts, including staff at other school districts. Because the messages came from legitimate, authenticated accounts, they could bypass normal email filters and help attackers move from one district to another. Attackers also used hijacked school accounts to pose as superintendents and commit fraud.
MS-ISAC tracked a pattern where attackers phished a single legitimate K-12 staff account, then used that account to send phishing messages to its contacts, including staff at other districts. Because the sending account was genuine and authenticated, the messages traveled over normal, trusted email paths. This let attackers hop from one district to another, expanding their reach with each successful compromise. MS-ISAC notified 808 of its 6,116 K-12 members that staff accounts or credentials were found circulating on underground and dark-web marketplaces, underscoring how widespread the exposure of school credentials has become.
In a related pattern, attackers used hijacked K-12 accounts to impersonate superintendents, sending fraudulent requests intended to look like they came from district leadership.
The core reason this technique worked is trust in the sender. Email filters and recipients alike are built to be more suspicious of spoofed or unfamiliar senders, but these messages came from real, previously trusted accounts. That authenticity weakened the filtering that schools normally rely on to catch phishing. Recipients had little reason to question a message that appeared to come from a known colleague or contact at another district, even when the request itself was unusual.
Survey data reinforces how central this issue is: phishing or email compromise was identified as the most common incident by 87% of surveyed districts, suggesting that account-based trust is a persistent weak point across the sector.
Districts and staff can reduce the impact of this account-hopping pattern by focusing less on whether a sender address looks genuine and more on whether the request itself is expected. Key practices include:
This pattern maps to known techniques including Phishing (T1566), Internal Spearphishing (T1534), Valid Accounts (T1078), and Impersonation (T1656), all of which rely on exploiting trust in legitimate, already-compromised accounts rather than technical deception alone.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers phished one legitimate district account, then used it to send phishing messages to that account's contacts, including staff at other districts.
The messages come from real, hijacked accounts over authenticated email paths, which weakens the filters schools rely on to catch phishing.
Attackers have posed as superintendents from hijacked K-12 accounts to commit fraud.
Phishing or email compromise was identified as the most common incident by 87% of surveyed districts.
That email from your district contact? It might really be their account. MS-ISAC tracked this: someone phishes one school staff account, then emails its contacts at other districts. The messages travel through authenticated email, so filters may miss them. Here's the tell: the address is genuine, but the request isn't. A familiar colleague suddenly wants a quick response, or a superintendent emails an unusual payment request. Before you act, call that person using a number you already have, not one in the email.
The report documents how criminals use antidetect browsers to make stolen sessions and phishing logins appear to come from legitimate, local devices. A commercially available Browser-in-the-Middle workflow can relay a victim’s login details to real services such as Google, Microsoft, Facebook, and…
Retailers face a peak-season gift-card fraud campaign in which attackers use phishing emails and text messages to trick employees into giving up credentials. After gaining access, the attackers use cloud systems and sensitive data to issue unauthorized gift cards at scale and convert them into…
Attackers are actively using fake human-verification prompts to persuade people to run commands through a legitimate, digitally signed Siemens application. The broader report also says SafePay ransomware operators gain access through phishing and stolen credentials, then target recovery data and…
ESET reports that North Korea-aligned Lazarus actors resumed using recruitment-themed social engineering to target the drone sector. A related North Korea-aligned operation, DeceptiveDevelopment, shifted from fake job interviews to compromising software supply chains by stealing developer…
Attackers used fake Microsoft sign-in pages and device-code phishing to capture or obtain authenticated Microsoft 365 sessions, bypassing the need to repeat multi-factor authentication. They then took over accounts, added their own devices and authentication methods, and hid messages with inbox…
Attackers used fake Microsoft sign-in pages and device-code tricks to steal completed Microsoft 365 login sessions, then replayed those sessions without needing passwords or new MFA approvals. After entering accounts, they registered rogue devices, replaced MFA methods, and hid mailbox messages,…
