Phishing emails target universities with ‘adult dating’ lure

An email phishing campaign that uses adult dating as a lure has targeted thousands of students across several U.S. universities to install a Trojan horse virus on their devices, according to a cybersecurity research group.

The campaign, which was discovered by the cybersecurity company Proofpoint, has delivered more than 150,000 messages across 60 industries since April, but nearly half of the messages targeted colleges and universities.

Initially, the email prompts recipients to connect with women by clicking on links over their pictures. When a link is clicked, an executable file is downloaded and, if opened, a virus called Hupigon is installed. Hupigon has been has been used since at least 2006, and according to security researchers can monitor webcams and log keystrokes.

“In this case, cybercriminals repurposed a nearly 15-year-old attack tool leveraged by state-sponsored threat actors among others,” Proofpoint researchers said in an analysis last week.

Phishing emails are a common attack vector in the education industry. A similar scam, which leverages peoples’ fear over the coronavirus pandemic, captured log-in credentials and infect computers with malware at several universities last month.