How hacked university emails turn into fake job offers

The scam does not start with a job offer. It starts with a warning that a university email account is about to be shut off. According to Proofpoint, this is the opening move in a two-stage fraud chain aimed at students, staff and alumni at U.S. universities.

Proofpoint has been tracking a cluster of this activity and found that it follows the pattern of known advance fee fraud, but starts with something less familiar: credential theft through ordinary web forms rather than fake login pages.

The account warning

The first email tells the recipient their account faces deactivation. The reason given is mundane: retirement, graduation, or transfer. That ordinariness is the point. Nobody questions a university notice about an account status change, because it sounds like routine institutional housekeeping rather than a threat.

The email links to a form, not a fake login page. Proofpoint found these forms hosted on legitimate platforms: Google Forms, Wix, Jotform, Zoho Forms, Microsoft Office. The form asks for a username, a password, and personal details. Because the form sits on a trusted platform rather than a suspicious domain, it does not trigger the usual instinct to check a web address before typing a password into it.

What the stolen account is used for

Once the threat actor has the login, the account itself becomes the tool. The attacker sends new messages from the compromised university address, this time offering jobs or internships. These messages carry the weight of a real .edu account, and that credibility travels both inside and outside the university, reaching contact lists built up over years.

The job offers are the second stage of the same fraud. Proofpoint identifies this stage as advance fee fraud, the pattern where a target is drawn in with a promised opportunity and eventually asked to pay or send something upfront before any job materializes.

Why students and alumni are targeted

Proofpoint points to three groups within a university who make convenient targets for different reasons. Younger students have less experience with email correspondence and are new to being approached about work or money. Alumni often keep an old university account active without checking it regularly, leaving a hijacked contact list unnoticed. Staff and faculty are used to a constant stream of email from students, parents and the wider community, which makes one more message easy to miss as unusual.

The step the scam depends on

The whole chain depends on the form-based credential harvesting page being hosted on a legitimate service rather than a scam-built site. That single choice is what lets the account deactivation email slip past the instinct to check a link before entering a password. Once that first form is filled in, the compromised account does the rest of the work, lending real institutional trust to a job offer that has nothing behind it.