Back-to-School Phishing Wave Hits the Education Sector

Education Is the Most Attacked Industry - Again

Every year, as students return to classrooms and campuses, attackers return with them. The back-to-school period concentrates everything a phishing operation loves: millions of new accounts being created, tuition and financial aid money in motion, and a flood of legitimate emails about enrollment, portals and passwords that makes fraudulent ones easy to hide. The pattern repeats every season, and the most recent full-season data shows just how large the wave has become.

According to 2025 findings from Check Point Research, education was the most targeted industry worldwide between January and July 2025, averaging 4,356 attacks per organization per week - a 41% increase year over year. The regional breakdown was even sharper: attacks on education organizations grew 67% year over year in North America and 48% in Europe.

Those are 2025 numbers, but the seasonal dynamic behind them is not going anywhere. Education combines enormous user populations, constant turnover of students and staff, decentralized IT, and budgets that rarely match the size of the attack surface. Attackers know the calendar as well as any registrar does, and they scale up accordingly every August and September.

Thousands of Fake School Domains in a Single Month

The infrastructure side of the wave is just as striking as the attack volume. In July 2025 alone, Check Point counted 18,391 newly registered domains related to schools, universities and students - and roughly 1 in every 57 of them was classified as malicious or suspicious, as IT Brew reported in its coverage of the research. That is a purpose-built supply chain of lookalike infrastructure, stood up in the weeks before students and staff start logging in for the new term.

What attackers do with those domains follows a well-worn playbook. Research from Doppel describes how threat actors clone university login portals pixel-perfect, sometimes hosting the fakes on compromised .edu domains to inherit the trust of a legitimate institution. Victims who enter their credentials hand over access to email, cloud storage and student information systems - and in higher education specifically, attackers use that access to redirect financial aid disbursements before anyone notices the money has moved.

The portal-clone tactic matters because it defeats the advice many users still rely on. A pixel-perfect copy of a familiar login page, reached from an email that looks like every other seasonal notice, gives the average student or staff member almost nothing visual to catch. The tell is in the sending domain and the URL, which is exactly the kind of checking behavior that has to be trained, not assumed.

Why the Wave Reaches Corporate Inboxes

If your organization has nothing to do with education, it would be a mistake to file this under someone else's problem. A significant share of your workforce is connected to the education system every September: parents paying tuition and receiving school communications, employees repaying student loans, staff enrolled in part-time degree or certificate programs, and recent graduates whose university accounts and loan servicers are still emailing them.

That means back-to-school lures land on work devices and in work inboxes. A fake tuition invoice, a bogus scholarship award, a student loan forgiveness offer, or a 'campus portal' password reset does not need to arrive at a corporate address to become a corporate problem - it only needs to be opened on a corporate laptop or to harvest a password the employee also uses at work. The United States Federal Communications Commission maintains a dedicated back-to-school scams advisory precisely because this category of fraud - student loan forgiveness schemes, scholarship offers and tuition payment scams - reliably spikes at this time of year and targets families, not just institutions.

Credential reuse is the quiet multiplier here. When an employee's personal university-alumni or loan-servicer password is phished and that password matches or resembles their corporate one, the seasonal scam becomes an enterprise intrusion. The lure was personal; the breach is yours.

Preparing Your Organization for the Seasonal Spike

The good news about a seasonal threat is that it is predictable, and predictable threats can be trained for on schedule. A few practical steps before the peak:

• Brief employees on the season's lures. A short, timely reminder that tuition invoices, loan forgiveness offers, scholarship notifications and campus portal resets are surging right now outperforms generic advice. Name the specific themes so people recognize them on arrival.
• Run a seasonally themed phishing simulation. Testing your workforce with the same lure types attackers are using this month - an education-themed payment request or portal reset - measures real readiness against the real threat. With empowsec you can schedule a back-to-school simulation campaign in September and compare click and report rates against your baseline.
• Make the personal-versus-work distinction explicit. Remind staff that personal-themed scams opened on work devices are a corporate risk, and that reporting them helps even when the lure has nothing to do with the company.
• Reinforce out-of-band verification for payments. Any request to pay tuition, change banking details or act on financial aid should be verified through a known channel, never through the contact details in the message itself.
• Watch your own lookalikes. If your organization operates in or adjacent to education, monitor newly registered domains that imitate your brand - the July 2025 registration surge shows how quickly attackers build lookalike infrastructure ahead of the season.

Security awareness training works best when it meets a threat that is actually in front of people. The back-to-school wave arrives on a known schedule, which makes it one of the easiest campaigns of the year to prepare for - if you start before the peak rather than after the first incident.

Key Takeaways

• Education was the most targeted industry worldwide in 2025, averaging 4,356 attacks per organization per week, up 41% year over year - and the back-to-school spike recurs every season.
• Attackers build infrastructure in advance. In July 2025 alone, 18,391 new school- and student-related domains were registered, with roughly 1 in 57 malicious or suspicious.
• Portal clones defeat visual inspection. Pixel-perfect copies of university login pages, sometimes hosted on compromised .edu domains, harvest credentials and redirect financial aid.
• The wave hits every workforce. Employees who are parents, students or loan holders receive these lures at work, and credential reuse turns personal phishing into corporate breaches.
• Predictable threats deserve scheduled defenses. Brief your staff on seasonal lures, run a themed phishing simulation in September, and reinforce out-of-band verification for any payment request.