Education Sector Credential Harvesting Surge: Typosquat Phishing Infrastructure Targeting Students — OTX Pulse Analysis & Detection Pack

Threat Summary

A live OTX pulse published by AlienVault (modified 2026-08-20, TLP:WHITE) confirms what Check Point Research has quantified: the education sector remains the most attacked vertical on the planet, absorbing an average of 4,696 weekly cyberattacks per organization between January and July 2026 — an 8% year-over-year increase and more than double the cross-industry average. Attack velocity peaked in July 2026 at 4,848 weekly attacks, aligning precisely with the back-to-school enrollment window.

The campaign profiled in this pulse is not a single named actor — it is an ecosystem of opportunistic credential-harvesting operators exploiting the academic calendar. The attack chain is consistent and repeatable:

1. Infrastructure staging — Actors register typosquat and lookalike domains imitating school portals, government education services, student loan programs, and discount programs (e.g., checkmyschool.org, education-gov.com, studentloansyyyy.com).
2. Lure delivery — Phishing emails and SMS messages themed around enrollment, tuition payment, financial aid disbursement, student discounts, and portal login verification target students, parents, and faculty.
3. Credential capture — Victims land on cloned login pages mimicking university SSO, learning management systems (Canvas, Blackboard, Moodle), or .gov education services. Credentials are harvested in real time.
4. Monetization — Stolen .edu credentials are resold on dark web credential markets and Telegram channels, then weaponized for VPN access, payroll diversion, W-2 theft, and as initial access into government and retail networks through password reuse.

The two MD5 file hashes in the pulse indicate the campaign is not purely web-based — payloads are being distributed alongside the phishing infrastructure, likely credential-stealing executables or malicious attachments disguised as enrollment documents, tuition invoices, or financial aid forms.

The objective is clear: bulk credential theft at the moment of maximum credential creation — when thousands of new students set passwords, when staff provision accounts, and when security teams are stretched thin onboarding new users.

Threat Actor / Malware Profile

Attribution: Unknown / multiple opportunistic actors. The pulse does not tie this activity to a single APT group; the domain registration patterns (generic keyword-stuffed domains with .online, .com, .org TLDs) are characteristic of low-to-mid sophistication cybercriminal phishing kit operators, many of whom purchase turnkey phishing panels from dark web marketplaces.

Distribution Method:

• Mass phishing email themed around back-to-school events: enrollment confirmation, tuition deadlines, student loan forgiveness, scholarship awards, discount programs
• Smishing (SMS) lures directing to cloned mobile-optimized login pages
• SEO poisoning and malicious ads surfacing fake portals for high-volume search terms ("student portal login," "financial aid status")

Payload Behavior:

• Browser-based credential capture via cloned SSO/LMS login pages with real-time exfiltration to attacker panels
• Session cookie theft enabling MFA bypass via adversary-in-the-middle (AiTM) phishing kits
• Executable payloads (represented by the MD5 hashes) disguised as PDF-grade documents or "required software" for enrollment, exhibiting infostealer-class behavior: browser credential store extraction, autofill data theft, and cookie harvesting

C2 / Exfiltration Communication:

• Credential panels typically exfiltrate over HTTPS to attacker-controlled domains or abuse legitimate services (Telegram Bot API, Discord webhooks, Google Forms) to blend into allowed traffic
• The typosquat domains themselves serve dual duty: lure hosting and exfiltration endpoints

Persistence:

• Stolen credentials are the persistence — actors replay logins against VPN, email (OWA/M365), and LMS portals, then establish forwarding rules and register their own MFA devices where conditional access is weak
• Executable-stage payloads commonly persist via Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) and scheduled tasks

Anti-Analysis Techniques:

• Phishing pages frequently implement bot/sandbox detection (IP geofencing, user-agent filtering, CAPTCHA gates) to hide content from security crawlers
• Short-lived domain registration with fast-flux hosting; domains like studentloansyyyy.com indicate bulk algorithmic registration intended for burn-and-churn operations

IOC Analysis

The pulse contains 7 indicators across 2 types:

SOC operationalization guidance:

• Domains are the highest-value indicators here. They represent live lure infrastructure. Import into your DNS firewall (RPZ), proxy blocklist, and M365 Defender custom indicators. Query historical DNS/proxy logs retroactively — a single resolution is a probable phish click requiring credential reset.
• MD5 hashes should be submitted to your EDR as file-level blocks and pivoted through VirusTotal/MalwareBazaar to extract SHA-256, imphash, and behavioral signatures for more durable detection.
• Tooling: OTX pulses can be auto-ingested via the OTX DirectConnect API into Splunk (OTX App), Microsoft Sentinel (OTX threat intelligence connector), MISP, or any STIX/TAXII-capable TIP. AlienVault OTXv2 Python SDK allows scripted pull-and-push to blocklists.
• Pattern-based expansion: The naming convention (student*, education*, *school* on cheap TLDs) should feed proactive domain-monitoring rules watching new certificate transparency log entries for your institution's brand keywords.

Detection Engineering

---
title: DNS Resolution of Education Typosquat Phishing Domains
id: 9f3a2b1e-4c7d-4e8a-b6f1-education001
status: experimental
description: Detects DNS queries for known back-to-school credential harvesting domains identified in OTX pulse targeting education sector students and staff
date: 2026/08/23
author: Security Arsenal Threat Intel
logsource:
    category: dns
product: windows
level: high
tags:
    - attack.t1566
    - attack.t1071.001
    - attack.t1583.001
detection:
    selection:
        QueryName|contains:
            - 'checkmyschool.org'
            - 'education-gov.com'
            - 'studentdiscount.online'
            - 'studentloansyyyy.com'
            - 'students-portal.com'
    condition: selection
falsepositives:
    - Threat intel validation lookups by SOC analysts
---
title: Execution of Known Credential Theft Payload Hashes
id: 7b1c4d2f-8e3a-4f5c-a2d9-education002
status: experimental
description: Detects execution of files matching MD5 hashes from the back-to-school education phishing campaign pulse, likely infostealer payloads disguised as enrollment or financial aid documents
date: 2026/08/23
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
level: critical
tags:
    - attack.t1204.002
    - attack.t1555
    - attack.t1056.001
detection:
    selection:
        Hashes|contains:
            - 'MD5=325d5de03758e3850dfae33e509afee9'
            - 'MD5=6d0bd9615d730b0b828f7f91c346085f'
    condition: selection
falsepositives:
    - None expected; known malicious hashes
---
title: Browser Credential Store Access Followed by Run Key Persistence
id: 3e8f1a5b-2c6d-4b7e-91a4-education003
status: experimental
description: Detects infostealer-class behavior consistent with education phishing payloads - access to browser Login Data stores combined with registry Run key persistence establishment
date: 2026/08/23
author: Security Arsenal Threat Intel
logsource:
    category: registry_set
    product: windows
level: high
tags:
    - attack.t1547.001
    - attack.t1555.003
    - attack.t1068
detection:
    selection_persistence:
        TargetObject|contains:
            - '\CurrentVersion\Run\'
            - '\CurrentVersion\RunOnce\'
    filter_system:
        Image|contains:
            - '\Program Files\'
            - 'C:\Windows\'
    condition: selection_persistence and not filter_system
falsepositives:
    - Legitimate software installers registering startup entries
    - IT deployment tooling

// Hunt: Education typosquat phishing domain contact + suspicious process execution
// Microsoft Sentinel / Defender XDR — lookback 14 days
let PhishDomains = dynamic(["checkmyschool.org","education-gov.com","studentdiscount.online","studentloansyyyy.com","students-portal.com"]);
let DomainHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (PhishDomains)
| project DomainHitTime=TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, LocalIP;
DomainHits
| join kind=leftouter (
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where FileName in~ ("chrome.exe","msedge.exe","firefox.exe","rundll32.exe","powershell.exe","wscript.exe","mshta.exe")
    | project ProcTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath, MD5
) on DeviceName
| where ProcTime between (DomainHitTime .. DomainHitTime + 10m)
| extend MD5Match = MD5 in ("325d5de03758e3850dfae33e509afee9","6d0bd9615d730b0b828f7f91c346085f")
| project DomainHitTime, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, MD5, MD5Match
| sort by DomainHitTime desc

# Education Phishing Campaign - Endpoint IOC & Persistence Hunt
# Checks: typosquat domain connections, malicious hash files, Run key persistence, suspicious tasks
# Run elevated on endpoints or deploy via RMM/SCCM

$PhishDomains = @("checkmyschool.org","education-gov.com","studentdiscount.online","studentloansyyyy.com","students-portal.com")
$MaliciousMD5 = @("325d5de03758e3850dfae33e509afee9","6d0bd9615d730b0b828f7f91c346085f")
$Findings = @()

Write-Host "[*] Checking DNS cache for typosquat phishing domains..." -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $PhishDomains) {
    $hit = $dnsCache | Where-Object { $_.Entry -like "*$d*" }
    if ($hit) { $Findings += [PSCustomObject]@{Type="DNSCache"; Indicator=$d; Detail="Resolved on this host - likely phish click"; Time=$hit.TimeToLive} }
}

Write-Host "[*] Checking active/recent network connections to phishing domains..." -ForegroundColor Cyan
Get-NetTCPConnection -ErrorAction SilentlyContinue | ForEach-Object {
    try { $r = Resolve-DnsName -Name $_.RemoteAddress -ErrorAction Stop -DnsOnly } catch { $r = $null }
    if ($r) { foreach ($d in $PhishDomains) { if ($r.NameHost -like "*$d*") { $Findings += [PSCustomObject]@{Type="NetConnection"; Indicator=$d; Detail="Active connection from PID $($_.OwningProcess) to $($_.RemoteAddress)"; Time="Now"} } } }
}

Write-Host "[*] Scanning user-accessible paths for malicious MD5 hashes..." -ForegroundColor Cyan
$ScanPaths = @("$env:TEMP","$env:USERPROFILE\Downloads","$env:USERPROFILE\Desktop","$env:APPDATA","$env:LOCALAPPDATA\Temp")
foreach ($p in $ScanPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -File -Include *.exe,*.dll,*.scr,*.js,*.vbs,*.ps1 -ErrorAction SilentlyContinue | ForEach-Object {
            $h = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            if ($h -and ($MaliciousMD5 -contains $h.ToLower())) { $Findings += [PSCustomObject]@{Type="MaliciousFile"; Indicator=$h; Detail=$_.FullName; Time=$_.LastWriteTime} }
        }
    }
}

Write-Host "[*] Auditing Run keys for suspicious persistence..." -ForegroundColor Cyan
$RunKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run","HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce","HKLM:\Software\Microsoft\Windows\CurrentVersion\Run","HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce")
foreach ($rk in $RunKeys) {
    if (Test-Path $rk) {
        Get-ItemProperty -Path $rk | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty -Path $rk -Name $_.Name).($_.Name)
            if ($val -match "AppData|Temp|Downloads|Public\\") { $Findings += [PSCustomObject]@{Type="Persistence-RunKey"; Indicator=$rk; Detail="$($_.Name) = $val"; Time="N/A"} }
        }
    }
}

Write-Host "[*] Auditing scheduled tasks launching from user-writable paths..." -ForegroundColor Cyan
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
    foreach ($a in $_.Actions) {
        if ($a.Execute -match "AppData|Temp|Downloads" -and $a.Execute -notmatch "OneDrive|Teams") { $Findings += [PSCustomObject]@{Type="Persistence-SchedTask"; Indicator=$_.TaskName; Detail="$($a.Execute) $($a.Arguments)"; Time="N/A"} }
    }
}

if ($Findings.Count -gt 0) { Write-Host "`n[!] FINDINGS DETECTED on $env:COMPUTERNAME:" -ForegroundColor Red; $Findings | Format-Table -AutoSize; $Findings | Export-Csv -Path ".\edu-phish-hunt-$env:COMPUTERNAME.csv" -NoTypeInformation }
else { Write-Host "`n[+] No indicators found on $env:COMPUTERNAME" -ForegroundColor Green }

Response Priorities

Immediate (0–4 hours)

• Block all 5 typosquat domains at DNS resolver (RPZ), web proxy, email gateway, and EDR network indicators. Block both MD5 hashes via EDR file reputation.
• Retro-hunt DNS and proxy logs for the past 90 days for any resolution of the listed domains — each hit is a probable credential compromise.
• Execute the KQL hunt and PowerShell sweep across the fleet, prioritizing student-facing and enrollment/financial-aid staff machines.
• Deploy the Sigma rules to your SIEM pipeline for ongoing detection.

24 Hours (Credential Response)

• For every host or user associated with a domain hit: force password reset and revoke all active sessions/refresh tokens (M365: Revoke-AzureADUserAllRefreshToken; on-prem: reset + krbtgt consideration if widespread).
• Assume harvested credentials are already listed on dark web markets — check credential exposure services and your own dark web monitoring for institutional email domains.
• Review MFA registration events for any new device enrollments in the last 30 days; attackers with stolen credentials commonly register their own MFA to persist.
• Audit mailbox rules on affected accounts for forwarding/exfiltration rules.

1 Week (Architecture Hardening)

• Enforce phishing-resistant MFA (FIDO2/passkeys) for students and staff; AiTM kits defeat SMS and TOTP.
• Implement newly registered domain (NRD) blocking at the proxy — these lure domains are typically days old when weaponized.
• Subscribe your institution's brand keywords (name, mascot, portal names) to certificate transparency and domain registration monitoring for proactive typosquat detection.
• Deploy browser isolation or link rewriting for external email during enrollment windows, and run targeted back-to-school phishing simulations.
• Tighten conditional access: block legacy auth, require compliant devices for SSO portal access.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub