Notifications
Clear all
Topic starter
27/06/2026 1:59 pm
TL;DR: Attackers are using compromised university accounts, cloned sign-in pages, and Duo OTP interception to scale account takeover across 40+ organisations and 30+ universities, then hide activity with mailbox rules and lateral phishing, according to Abnormal AI. The programme gap is not MFA alone, but trust, inbox, and behavioural controls that assume institutional email remains benign.
NHIMG editorial — based on content published by Abnormal AI: Compromising campus accounts with credential and Duo OTP theft
By the numbers:
- Abnormal researchers identified more than 40 compromised organizations in this campaign.
- The campaign targeted over 30 universities and colleges.
Questions worth separating out
Q: How should security teams respond when a trusted internal account starts sending phishing emails?
A: Treat the sender as potentially compromised immediately, even if the message originated inside the organisation.
Q: Why do Duo OTPs and similar one-time codes still fail against phishing?
A: They fail when attackers can control the entire login flow and capture both the primary credential and the second factor in sequence.
Q: What breaks when attackers create mailbox rules after account takeover?
A: Visibility breaks first, because alerts can be suppressed or redirected before the user notices suspicious activity.
Practitioner guidance
- Detect compromised sender behaviour Alert on unusual sending volume, new recipients, and message patterns from internal university accounts, especially when the sender identity has recent sign-in anomalies or impossible travel signals.
- Harden inbox rule governance Block or review high-risk mailbox rules that forward mail externally, suppress alerts, or auto-delete messages, and treat new rule creation as a high-priority compromise indicator.
- Reduce OTP replay value Shorten one-time password validity where possible and prefer phishing-resistant authentication for staff accounts that can access payroll, finance, or administrator workflows.
What's in the full article
Abnormal AI's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step attack flow showing how the phishing kit captures credentials and Duo OTPs across multiple pages.
- Additional lure examples and URL obfuscation details that help practitioners recognise campaign variation.
- JavaScript and POST-request handling used to exfiltrate OTPs, useful for defenders building detections.
- Victimology and indicators of compromise that support incident triage and campaign scoping.
👉 Read Abnormal AI's analysis of campus account takeover and Duo OTP theft →
Higher ed phishing and OTP theft: what IAM teams need to harden?
Explore further
27/06/2026 3:33 pm
Trusted internal identity has become an attack delivery system, not just an authentication boundary. The campaign works because compromised university accounts inherit institutional credibility that external filters and human recipients are inclined to trust. That creates a governance gap across IAM, email security, and user behaviour, because the organisation’s own identity fabric is now the phishing infrastructure. Practitioners should treat internal sender trust as a control surface, not a default assumption.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Which identity controls matter most when phishing comes from compromised university accounts?
A: Prioritise authentication monitoring, mailbox-rule controls, and behavioural detection on internal senders. External filtering alone is insufficient because the attacker already has a trusted origin. University environments should also review access to payroll, finance, and administrative mailboxes more aggressively than general user accounts.
👉 Read our full editorial: Campus account takeover campaigns are bypassing MFA in higher education
