Recent Education Sector Cyber Attacks

A real campaign called Yoba used fake GitHub projects for supposed ChatGPT and Claude desktop applications to lure people into downloading malicious ZIP installers. The installers included legitimate signed OpenAI or Anthropic programs alongside malicious files, ultimately installing a…

The Yoba malware campaign uses fake GitHub projects and search-result manipulation to make counterfeit ChatGPT and Claude downloads look trustworthy. Victims receive a real, signed installer alongside malware, so the application appears legitimate while the malicious software installs and…

Microsoft reports that North Korean threat actors are using AI to make job scams, fake recruiter outreach, fraudulent worker identities, and targeted phishing campaigns faster and more convincing. One group posed as recruiters for a spoofed AI blockchain company and scheduled software-engineer…

After a ransomware attack disrupted University of New Mexico healthcare services, the BYOD ransomware group allegedly offered free decryption keys but said it would retain stolen patient and employee data. The group told affected people to contact it directly and pay $2,500 to have personal…

Attackers used GitHub and search results to promote counterfeit ChatGPT and Claude desktop downloads. The ZIP files bundled real signed OpenAI or Anthropic executables with malicious files, tricking Windows users into launching malware that can persist on the device and install a cryptocurrency…

MS-ISAC tracked attackers who used a phished K-12 staff account to send phishing messages to that employee’s contacts, including staff at other school districts. Because the messages came from legitimate, authenticated accounts, they could bypass normal email filters and help attackers move from…

South Korean police say a suspected hacker breached 60 organizations and stole personal and business data, then used the threat of public disclosure to demand payment. The group reportedly sent extortion emails and escalated to calls and text messages to executives and employees when organizations…

Microsoft is adding AI-based phishing detection to Teams after attackers repeatedly used external chats to impersonate support staff, send malicious files, and deliver fake billing notices. The reported attacks exploit Teams' default external-access feature rather than a software flaw, making…

A real malware campaign called Yoba used fake GitHub projects advertising supposed ChatGPT and Claude desktop applications. Victims were lured by high-ranking Google results and download buttons, then ran ZIP-packaged installers that appeared legitimate but gave attackers control of the device. The…

Check Point Research identified a real campaign, tracked as Yoba, that uses fake GitHub projects and websites posing as new ChatGPT and Claude desktop applications. Victims searching for AI tools can be directed to convincing pages for supposed releases such as GPT-6 Astra and Claude Opus, then…

A cyberattack disrupted University of New Mexico Health hospitals, forcing ambulance diversions and canceled clinical appointments. During the incident, attackers reportedly played a synthetic voice message on hospital workers’ computers claiming they had stolen sensitive data and directing…

The article recounts the real ILOVEYOU worm outbreak, which used a romantic email subject line and a supposed love-letter attachment to trick millions of recipients into infecting their computers. Once opened, the attachment spread the same message to everyone in the victim's address book, showing…

Federal investigators are examining alleged links between ShinyHunters and ransomware negotiation executives. The article also documents a real Dharma ransomware exchange in which the attacker steered a victim toward an alleged Canadian IT intermediary, using a reassuring “guarantees” offer to keep…

A group of men in Lagos, Nigeria used a fake Instagram profile posing as an attractive young woman to build trust with 17-year-old Jordan DeMay. After exchanging messages and a purported nude image, Jordan sent an explicit photograph, exposing him to a sextortion scheme designed to pressure victims…

Researchers disclosed SearchLeak, a Microsoft 365 Copilot Enterprise vulnerability chain that reportedly let a single crafted-link click turn a user’s AI assistant into a tool for collecting and sending out sensitive data. The attack abused prompt injection and trusted Microsoft infrastructure,…

A tracked threat group (UAT-11985) sent tailored event-invitation lures to people tied to Taiwan research organizations, trying to trick them into “registering” through a fake Google Form flow. Victims who clicked a disguised link or scanned a tampered QR code were pushed to a convincing Google…

Microsoft says it uncovered and disrupted an underground marketplace (“YAM Store”) that sold phishing kits and access to cloud accounts, enabling massive global phishing and SMS scam campaigns. The operation allegedly supported over a billion scam messages since January 2026 and targeted 75,000+…

Microsoft says it used a U.S. court order to seize and redirect domains tied to three Chinese-run phishing platforms that helped send hundreds of millions of scam messages worldwide. The platforms provided ready-made fake pages and messages impersonating trusted organizations, mainly to steal…

Microsoft and Health-ISAC disrupted a Chinese-language phishing marketplace ecosystem (YAM Store, CoGUI, and Iron Man) that enabled criminals to send over a billion malicious messages globally. The services sold phishing kits, compromised accounts, and infrastructure, and were frequently used to…

This weekly threat bulletin highlights multiple real-world incidents and campaigns, including phishing operations aimed at tricking people into handing over credentials. One campaign targeted Taiwanese research organizations with event-invitation emails, QR codes, and fake Google login pages…