Education Phishing Teardowns

Every Attack of the Day teardown where the targeted organization was in education, newest first. Real attacks on schools and universities, dissected: the headers, the lure, and why it got past the first line of defense. Targeted organizations are never named.

All teardownsManufacturingHealthcareFilter in the ExplorerEducation email security

2026

• Fully Signed, Fully Passed: The Reply-To Was the Payload2026-09-02
• DKIM and DMARC Passed. The $97,500 Wire Was Fraud.2026-07-26
• The Squarespace Phish With No Brand Text to Match2026-07-18
• Full Authentication Pass, Zero Legitimacy: How a 26-Day-Old Domain Ran ACH Fraud2026-06-30
• A One-Line Curiosity Hook Sent a K-12 Teacher to a Same-Day Phishing Domain on Port 84432026-06-23
• re: plans for party -- How a Compromised Argentine School Account Targeted K-12 in the U.S.2026-06-21
• McAfee Invoice Scam Weaponized a Google Calendar Invite 71 Minutes After Domain Registration2026-05-31
• The Childcare App That Passed Every Security Check (The Reply-To Header Didn't)2026-04-14
• The Timestamp That Gave It Away: Oracle Identity Cloud Phishing Targets K-12 with a Stale Timezone2026-04-10
• The Email That Passed Every Security Check (Because Adobe Sent It)2026-03-31
• When SPF, DKIM, and DMARC All Pass. And the Email Is Still Phishing2026-03-21
• The Phishing Link Lived on a Domain That Didn't Exist Nine Hours Earlier2026-03-14
• Legit Ticket, Lethal Link: A Real Telecharge Newsletter Hid a PII Harvester on Cloudflare Pages2026-01-28

2025

• The Photograph Link That Vanished Before Anyone Could Scan It2025-12-22
• Every Authentication Check Failed. An Allow-List Let It Through Anyway.2025-11-16
• DKIM Pass, SPF Pass, DMARC Pass: The Phish That Aced Every Authentication Check2025-11-04
• The Curiosity Lure Sent From a Compromised Moroccan Training Account2025-10-10
• A Geek Squad Calendar Invite With No Links, No Malware, and a Phone Number2025-09-12
• The PDF That Fired Before You Read It: AICPA Impersonation and an S3-Hosted Adobe Typosquat2025-07-29
• His Name in the From Field, Someone Else's Bank Account: Political Donation Impersonation via bluevision24.com2025-07-15
• Clio Platform Abuse: HMAC-Tokened Invoice Links and a Fabricated Internal Thread2025-07-07
• Authenticated Education Sender, Malicious Study-Abroad Link, and a Student File as Bait2025-07-05
• Lure Text You Recognize, Destination You Can't See: How a Yahoo Sender Weaponized a Corporate Brand2025-06-26
• Bitcoin Sextortion via Spoofed Legitimate Domain: SPF Softfail Lets Extortion Template Through2025-06-17
• When a Trusted University Account Delivers a Same-Day-Registered Phishing Link2025-05-28
• Free Gmail Sender, Nigerian IP, Freshly Registered Reply-To: Inside a Bapco Energies Vendor BEC2025-05-19
• Compromised University M365 Account Delivers Thread-Hijacked Email With Malicious QR Shortlink and Suspicious Image Payloads2025-05-18
• Disney+ Billing Lure Rides Legitimate Tax-Service Infrastructure to a phpList Subscribe Page2025-05-16
• The Email Inside the Email: How a Nested .eml and Microsoft Short Links Blind Inline Scanners2025-05-04
• Inside the Wrapper: How a Pre-Wrapped SafeLinks URL Became the Attack's First Layer of Cover2025-04-11
• Clean Scan, Full Auth, One Phone Number: A Compromised School Account Carrying a TOAD Payload2025-04-07
• Aged Domain, Cloud Rail, Fake Portal: How a Compromised 1998 Domain Delivered an EFT Credential Harvest via Amazon SES2025-04-06
• Credential Phish by Day, Remote-Access Trojan by Night2025-03-27
• DocuSign With No Subject: Two Hops to a Malicious Page2025-02-14
• A Student Account Weaponized Google's Own Script Engine2025-01-04

2024

• The OAuth Consent Phish Riding Microsoft's Real Login2024-12-05
• The DOCX That Was Actually a Fake M365 Admin Console2024-11-21
• The Blog Notification That Was a Vishing Scam2024-11-03
• A Real OneDrive Share Email, Built to Map an Inbox2024-11-02
• A Same-Day Domain, a McAfee Calendar Invite, Two Prices2024-10-21
• The Meta Verified Scam That Forgot to Fill In the Blanks2024-09-23
• A Zoom Calendar URL Where the Sender Should Be2024-09-20
• Look-Alike Letters Hid an Investment Scam From Filters2024-09-18
• The Calendar Invite Was the Whole Attack2024-09-10
• The Card Was Real, the Button Was Not2024-08-16