✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Higher Education/Acadamia
Breach intelligence, attack campaigns, and threat reports targeting the Higher Education/Acadamia sector.
Explore Other Sectors
Higher Education/Acadamia Threat Reports
Starkiller Phishing Kit: A New Era of MFA Bypass Attacks
In February 2026, cybersecurity researchers uncovered 'Starkiller,' a sophisticated phishing-as-a-service platform developed by the cybercrime group Jinkusu. Unlike traditional phishing kits that use static replicas of login pages, Starkiller employs a headless Chrome browser within a Docker container to proxy live login pages of targeted brands such as Microsoft, Google, and Apple. This method allows attackers to capture user credentials, including multi-factor authentication (MFA) codes, in real-time by acting as a man-in-the-middle between the victim and the legitimate site. The platform offers features like keylogging, session token theft, geo-tracking, and real-time session monitoring, all accessible through an intuitive dashboard that lowers the technical barrier for cybercriminals. ([krebsonsecurity.com](https://krebsonsecurity.com/2026/02/starkiller-phishing-service-proxies-real-login-pages-mfa/?utm_source=openai)) The emergence of Starkiller signifies a significant escalation in phishing tactics, reflecting a broader trend toward commoditized, enterprise-style cybercrime tooling. Its ability to bypass MFA protections and its user-friendly interface make it a potent tool for attackers, necessitating a shift in defensive strategies toward behavioral detection and identity-aware analysis to effectively counter such advanced threats. ([darkreading.com](https://www.darkreading.com/threat-intelligence/starkiller-phishing-kit-mfa?utm_source=openai))
5 months ago
Kill Chain
Roundcube 2025 Remote Code Execution Vulnerability
In June 2025, a critical vulnerability (CVE-2025-49113) was identified in Roundcube Webmail versions prior to 1.5.10 and 1.6.11. This flaw allowed authenticated users to execute arbitrary code on the server due to improper validation of the '_from' parameter in the 'upload.php' script, leading to PHP object deserialization. Exploitation of this vulnerability could result in complete server compromise, unauthorized access to sensitive email data, and potential lateral movement within the network. ([feedly.com](https://feedly.com/cve/CVE-2025-49113?utm_source=openai)) The discovery of this vulnerability underscores the importance of rigorous input validation and prompt patch management. Organizations using affected versions of Roundcube Webmail are urged to upgrade to the latest versions to mitigate potential exploitation risks.
5 months ago
Kill Chain
UMMC Ransomware Attack Disrupts Healthcare Services in Mississippi
In February 2026, the University of Mississippi Medical Center (UMMC) experienced a significant ransomware attack that led to the closure of all its clinics statewide and the cancellation of elective procedures. The cyberattack compromised multiple IT systems, including the Epic electronic medical records platform, necessitating the implementation of downtime procedures to maintain patient care. Emergency services remained operational, but the disruption affected numerous outpatient services and appointments. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/university-of-mississippi-medical-center-closes-clinics-after-ransomware-attack/?utm_source=openai)) This incident underscores the escalating threat of ransomware attacks targeting healthcare institutions, highlighting the critical need for robust cybersecurity measures to protect sensitive patient data and ensure the continuity of medical services.
5 months ago
Kill Chain
ClickFix Campaign 2026: Unveiling the MIMICRAT Malware Threat
In February 2026, a sophisticated cyber campaign known as ClickFix was identified, leveraging compromised legitimate websites to distribute a custom remote access trojan (RAT) named MIMICRAT. The attack initiated through a legitimate Bank Identification Number (BIN) validation service, bincheck.io, which was breached to inject malicious JavaScript. This script redirected users to a fake Cloudflare verification page, prompting them to execute a PowerShell command that ultimately deployed MIMICRAT. The RAT featured capabilities such as Windows token impersonation, SOCKS5 tunneling, and a suite of 22 commands for extensive post-exploitation activities. Victims spanned multiple geographies, including a U.S.-based university and various Chinese-speaking users, indicating broad opportunistic targeting. This incident underscores the evolving nature of cyber threats, where attackers exploit trusted websites to deliver sophisticated malware. The use of multi-stage PowerShell scripts and the deployment of custom RATs like MIMICRAT highlight the increasing complexity of attack vectors. Organizations must remain vigilant, ensuring robust security measures are in place to detect and mitigate such advanced threats.
5 months ago
Kill Chain
BeyondTrust CVE-2026-1731 Exploitation: A 2026 Cybersecurity Incident
In February 2026, a critical vulnerability (CVE-2026-1731) in BeyondTrust's Remote Support (RS) and Privileged Remote Access (PRA) products was actively exploited by threat actors. This pre-authentication remote code execution flaw allowed attackers to execute operating system commands as the site user, leading to unauthorized access, data exfiltration, and service disruptions. The attacks targeted sectors including financial services, legal services, high technology, higher education, wholesale and retail, and healthcare across multiple countries. The exploitation involved deploying web shells, backdoors, and remote management tools, facilitating lateral movement and data theft. Notably, malware such as VShell and Spark RAT were utilized. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities catalog to include CVE-2026-1731, confirming its use in ransomware campaigns.
5 months ago
Kill Chain
Critical Vulnerabilities in EnOcean SmartServer IoT: Immediate Action Required
In February 2026, critical vulnerabilities were identified in EnOcean's SmartServer IoT versions up to 4.60.009. These flaws, CVE-2026-20761 and CVE-2026-22885, allowed remote attackers to execute arbitrary OS commands and cause memory leaks via specially crafted LON IP-852 management messages. Exploitation could lead to unauthorized control over affected devices and potential data breaches. EnOcean promptly addressed these issues by releasing SmartServer 4.6 Update 2 (v4.60.023) and provided a hardening guide to enhance security measures. Organizations utilizing SmartServer IoT are urged to update to the latest version and implement recommended security practices to mitigate risks associated with these vulnerabilities.
5 months ago
Kill Chain
Lithuania's Digital Infrastructure Compromised by AI-Driven Social Engineering Attacks in 2026
In early 2026, Lithuania faced a surge in AI-driven social engineering attacks targeting its digital infrastructure. Cybercriminals utilized advanced AI tools to craft highly personalized phishing campaigns, deepfake videos, and voice-cloned calls, deceiving individuals into divulging sensitive information. These sophisticated attacks led to significant data breaches across various sectors, including finance and public services, compromising personal data and undermining trust in digital platforms. This incident underscores the escalating threat of AI-enhanced cyber fraud, highlighting the need for robust cybersecurity measures and public awareness. As AI technologies become more accessible, the potential for their misuse in cyberattacks grows, necessitating proactive defense strategies and continuous monitoring to safeguard digital ecosystems.
5 months ago
Kill Chain
Google Chrome Zero-Day Exploit CVE-2026-2441 Patched
In February 2026, Google addressed a high-severity vulnerability in its Chrome browser, identified as CVE-2026-2441. This use-after-free flaw in the CSS component allowed remote attackers to execute arbitrary code within the browser's sandbox via crafted HTML pages. Security researcher Shaheen Fazim reported the issue on February 11, 2026, and Google released patches for Windows, macOS, and Linux shortly thereafter. The vulnerability was actively exploited in the wild, though specific details about the attacks remain undisclosed. This incident underscores the persistent threat posed by zero-day vulnerabilities in widely used software. The exploitation of CVE-2026-2441 highlights the importance of timely software updates and robust security practices. Users are urged to ensure their browsers are updated to the latest versions to mitigate potential risks.
5 months ago
Kill Chain
Illinois Man's Phishing Scheme Compromises Hundreds of Women's Snapchat Accounts
Between May 2020 and February 2021, Kyle Svara, a 26-year-old from Illinois, orchestrated a phishing campaign targeting nearly 600 women to gain unauthorized access to their Snapchat accounts. By impersonating Snap Inc. representatives, he solicited security codes from over 4,500 individuals, successfully compromising at least 59 accounts to steal and distribute private images. Notably, Svara collaborated with former Northeastern University track coach Steve Waithe, who hired him to hack accounts of female student-athletes. Waithe was sentenced to five years in prison in March 2024 for related offenses. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/man-pleads-guilty-to-hacking-nearly-600-womens-snapchat-accounts/?utm_source=openai)) This incident underscores the persistent threat of social engineering attacks and the exploitation of personal data for malicious purposes. Organizations must remain vigilant against such tactics, emphasizing the importance of user education and robust security measures to protect sensitive information.
5 months ago
Kill Chain
Substack's 2025 Data Breach: A Wake-Up Call for Security Monitoring
In October 2025, Substack, a prominent newsletter platform, experienced a data breach where an unauthorized third party accessed user data, including email addresses, phone numbers, and internal metadata. The breach was not detected until February 3, 2026, leading to a four-month delay in notification. Importantly, sensitive information such as passwords, credit card numbers, and financial data remained secure. ([techcrunch.com](https://techcrunch.com/2026/02/05/substack-confirms-data-breach-affecting-email-addresses-and-phone-numbers/?utm_source=openai)) This incident underscores the critical need for robust security monitoring and rapid breach detection mechanisms. The prolonged detection period highlights potential vulnerabilities in Substack's security infrastructure, emphasizing the importance of timely incident response to protect user data and maintain trust.
5 months ago
Kill Chain
La Sapienza University Ransomware Attack: A 2026 Case Study
In early February 2026, La Sapienza University in Rome, one of Europe's largest educational institutions, experienced a significant cyberattack attributed to the pro-Russian group Femwar02. The attackers deployed the BabLock (also known as Rorschach) ransomware, leading to the encryption of critical data and the disruption of numerous IT services. In response, the university proactively shut down its network systems to safeguard data integrity and initiated restoration efforts with the assistance of Italy's National Cybersecurity Agency. ([techcrunch.com](https://techcrunch.com/2026/02/05/one-of-europes-largest-universities-knocked-offline-for-days-after-cyberattack/?utm_source=openai)) This incident underscores the escalating threat of sophisticated ransomware attacks targeting educational institutions, highlighting the urgent need for enhanced cybersecurity measures and preparedness within the sector.
5 months ago
Kill Chain
Spain's Ministry of Science 2026 Data Breach: A Wake-Up Call for Government Cybersecurity
In early February 2026, Spain's Ministry of Science, Innovation, and Universities experienced a significant cybersecurity incident. A threat actor known as 'GordonFreeman' claimed to have exploited an Insecure Direct Object Reference (IDOR) vulnerability, combined with leaked credentials, to gain full administrative access to the ministry's systems. The attacker allegedly exfiltrated sensitive data, including personal records, email addresses, enrollment applications, and official documents. In response, the ministry partially shut down its IT systems, affecting various services for researchers, universities, and students, and suspended all ongoing administrative procedures to assess and mitigate the breach. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/spains-ministry-of-science-shuts-down-systems-after-breach-claims/?utm_source=openai)) This incident underscores the critical importance of robust access controls and vulnerability management within governmental institutions. The exploitation of an IDOR vulnerability highlights the need for comprehensive security assessments and prompt remediation of identified weaknesses. Additionally, the breach serves as a reminder of the persistent threats posed by cyber actors targeting sensitive governmental data, emphasizing the necessity for continuous monitoring and incident response preparedness.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports