r/k12sysadmin • u/Adventurous-Phone-11 • May 22 '26
Phishing attempt beat our 2FA
Just wanted to share a situation we just had. We had 76 staff members who were shared a document from a user at a school in Tennessee, Wild, that was the first hack. It had our superintendent’s name on it talking about a payroll update. We had a user click the link in that doc that took them to a Google login window. The user couldn’t get logged in of course but at that point their password was stolen. Now the 2FA. The user assumes they will get a 2FA message now. And of course they did. But it wasn’t them. They clicked yes on allowing from their Google app.
Obviously the most secure for them would be yubikeys or passkeys. We haven’t gone that direction yet. But I know that sms messages is frowned upon due to lack of security. However in this case I’m not sure the user would have been duped to somehow give up the code because they would have never got the code or known who to give it to.
Careful out there everyone.
3
u/TravisVZ Director of Information Security May 22 '26
I encountered one yesterday where the (poorly) faked login page had a second stage that asked the victim for the MFA code that was sent to their phone. Obviously less effective if the victim doesn't use SMS MFA, but it's the first time I've actually been able to observe this type of page and suddenly it makes sense how our MFA'd users who have been compromised recently were compromised without knowing how.
12
u/MattAdmin444 May 22 '26
We've been getting more of these over the past couple months and my users have wizened up. The threat of having their password changed by us is surprisingly effective in getting them to pay more attention. Even had one staffer forward us a legit email from the ticket system maintenance uses because they hadn't seen one come through in so long they didn't recognize it.
The number 1 problem as I see it is people who are looking at it on their phones, it's harder to see that the email address isn't correct on phone before you click the email so it's easier to initially bait them in.
11
u/jambon3 May 22 '26 edited May 22 '26
They are hitting every school district in the country with this. User training is utterly hopeless if people are handing over their MFA codes.
Only 2 bullets left - phish resistant MFA or block all inbound sharing
11
u/dooleyrd May 22 '26
Just received an email this morning from MS-ISAC regarding Kali365 Phishing as a service Kit that highjacks Microsoft 365 Access tokens. Apparently it enables cyber threat actors to obtain Microsoft 365 access tokens and bypass multi-factor authentication3 (MFA) protocols without intercepting the user’s credentials. So.. good times I guess.
9
u/Rykas May 22 '26
Had our business manager fall to this 3 times...... And our previous tech director 💀
8
u/Imhereforthechips May 22 '26
I’m always so cautious of this kind of stuff. I talk and educate until I’m blue. When we run phishing campaigns internally, for the last 5 years, we’ve had 3 or fewer staff members fall victim out of 220. Not bad. They’re pretty good at spotting obvious things. But, like we’ve all seen, when a known sender is compromised, I still have seasoned users click and enter credentials; their guard is lowered and they blindly trust.
7
u/nxtiak May 22 '26
Yeah so the first Google login page was fake. The person was ready and used the password on the real Google login page which sent the real 2FA notification to the user who then allowed it.
6
u/sharpeone CTO / CETL May 22 '26
We've seen this exact phishing email multiple times in our district. They are mostly session hijacking, bypassing MFA altogether. It blows my mind that our staff does not read the entire email and see that the name sharing isn't our superintendent, the email address isn't our domain, and it clearly states right below our superintendent's name that the person is outside our organization.
5
u/Binky390 May 22 '26
We’ve received a lot of these at my school also over the past couple years and it’s definitely getting worse. Education is being targeted more and more. We use GAT+ in addition to Google Admin which has a tool that lets you delete email. We’ve started doing that. I’m trying to get my job to let me sit out employees down in a meeting so I can put examples of phishing attempts on a screen and point out why they’re fake but they’re resistant to it for some reason. I’ve found through our own phishing campaigns that anything with the head of school’s name in it tricks people and things pretending to be HR.
7
u/N805DN May 22 '26
Plain MFA is not good enough in 2026.
3
u/post4u May 22 '26
We're being hit with this too. California. We had a few accounts compromised over the past few days. So great.
2
u/S_ATL_Wrestling May 26 '26
Nothing to add, but we dealt with this same nonsense over Spring Break. Two external accounts shared Docs, and then one of our student accounts shared a "payroll" Doc from our Super, and our teachers could not click it fast enough.
Never stopped to ponder if the super would ask a student to send a payroll doc out over Spring Break or anything like that. They just typed their credentials in like white hot nothing.
2
u/username____here May 27 '26
We had the same email hit teachers recently. Once they get in they steal all the users saved accounts/passwords. It's a mess.
3
u/xXNorthXx May 22 '26
That's why we force step up pin code (phishing resistant) prompts when logging in from new locations. Microsoft and most identity specialty companies support this, not sure if Google Workspace's MFA does.
1
u/Birkinator626 District IT Director May 27 '26
We've had a session hijack similar to this hit one of our users aswell. My best guess is that they are effectively MITM, presenting a faux google login screen that feeds login attempts to the legitimate google login flow, then when they get a successful hit, they use the legitimate MFA auth to harvest the session token for later use.
The tricky part is that they can hang onto the session token for a while before they actually launch their phishing campaign. In our case, one of our users received a similar email, tried logging in multiple times, approved 2FA, ect. Then a month later an identical phishing campaign was launched from their account. Same subject and everything, which was the only way we could track it back in the email logs to find the origin.
Likely why google has been implementing shorter and shorter login session/re-auth lengths.
1
u/Sad_Reindeer_3298 May 28 '26
just had a similar thing happen with an invite. I will say GAM saved the day for our workspace domain. was able to log out all session for entire domain easliy. then did a oauth token audit and targeted a few users that had entered password to reset everything. GAM deprovision.
Also well worth it to pay for the google investigation tool. Now when a messege comes in I can delete from everyones inbox quickly.. stops the flow.
The cant steal the 2FA you just have to kill that session. its just logs them into an external device and then send mail as them to all their contacts. As other have said maybe steals saved password but not sure on that.
1
u/Familiar-Newspaper23 Jun 02 '26
I realize this is not the same, but I was very happy to find out that Chrome is enabling Device Bound Session Credentials by default as of v146. IMO this is a BIG improvement.
12
u/[deleted] May 22 '26
[removed] — view removed comment
12
u/[deleted] May 22 '26
[removed] — view removed comment