Universities worldwide are being targeted by a sophisticated phishing campaign disguised as sexual misconduct allegations. The emails exploit urgency, fear and reputational pressure to persuade recipients to open malicious content linked to the Zoho Remote Access Trojan (RAT), potentially giving attackers control over infected devices and access to sensitive institutional data.

Key takeaways

• Attackers use fake sexual misconduct complaints as emotionally charged phishing lures.
• The campaign deploys a Zoho-themed remote access tool designed to enable covert device access.
• Universities are attractive targets because they hold extensive personal, financial and research data.
• Email authentication, user awareness and prompt incident response can reduce exposure.

The campaign demonstrates how criminals increasingly combine social engineering with malware. Rather than relying on an obvious invoice or password-reset message, the attackers create a highly personal scenario that recipients may feel compelled to investigate immediately.

How the phishing campaign works

The messages reportedly claim to contain information about alleged sexual misconduct, creating pressure for staff or administrators to respond discreetly and quickly. Links or attachments in the emails can lead to malware delivery, credential theft or further interaction with the attacker.

The use of a Zoho-branded or Zoho-related remote access tool is particularly notable. A remote access trojan can allow attackers to monitor activity, collect files, capture credentials and establish persistence. The presence of a familiar productivity brand may also make the message appear more credible, even when the email did not originate from a legitimate Zoho service.

Why universities are vulnerable

Higher education organisations manage large, decentralised email environments. Students, academics, contractors and administrators may use different systems, while departments often handle sensitive matters independently. This complexity makes consistent security training, account management and incident reporting more difficult.

A compromised account can also provide a route to confidential disciplinary records, research material, financial information and personal data. Attackers may use stolen accounts to send convincing follow-up messages internally, expanding the campaign beyond its original recipients.

Practical protection for organisations

Security teams should treat unexpected allegations, legal notices and disciplinary complaints as high-risk messages when they create pressure to click, download or keep the matter secret. Recipients should verify the sender through a trusted channel and avoid opening unexpected files on their primary device.

For smaller organisations, including businesses that work with universities, basic email administration is an important part of defence. Correct MX records help route mail properly, while SPF and DKIM help validate legitimate senders. DMARC adds a policy layer that can instruct receiving systems what to do with messages that fail authentication. These controls cannot stop every impersonation attempt, but they make domain spoofing more difficult.

Email Workspace Administration supports Google Workspace and Zoho Mail setup, domain configuration, authentication records and ongoing user security administration. A properly managed platform can also help businesses enforce stronger sign-in controls, remove unused accounts and respond quickly when a mailbox is compromised.

What to do after a suspected infection

Anyone who opened a suspicious attachment, followed an unexpected link or entered credentials should report it immediately. The organisation should isolate the device, reset affected passwords from a clean device, revoke active sessions and review mailbox rules for unauthorised forwarding or deletion. It should also investigate related accounts and preserve evidence before removing the malware.

Prompt action limits the attacker’s opportunity to move through the organisation. Regular reviews of users, permissions, DNS records and email authentication provide a practical foundation for reducing the impact of similar campaigns.