Scammers Hijack US University Emails to Target Students With Fake Jobs

Cybercriminals are targeting college students with an advance-fee scam that uses hijacked university email accounts to advertise fake jobs, according to security researchers at Proofpoint. The researchers said they uncovered the operation after posing as job applicants.

The scam begins with a phishing email sent to an address ending in .edu. It claims the account will be deactivated and asks the recipient to verify the address by sharing their password. Once scammers gain access, they use the account to send fake job offers to students and other .edu addresses in the contact list.

Applicants who are told they got the job receive a copy of a $1,000 check and instructions to deposit it, keep half as pay, and buy gift cards with the other half to send back. When a bank later reverses the fake deposit, the victim is left $500 short.

Proofpoint said the scammers may pressure people who do not follow the instructions, including by suggesting other payment services or calling while pretending to be an FBI agent. Researchers traced activity linked to the operation to Nigeria, but said attribution to a particular group is difficult. They said the location assessment was based on their investigations and the scammers’ use of mobile network infrastructure.

Proofpoint said it does not know how many people were affected or how long the operation has been running.