Identity

Stolen school staff logins are phishing the next district

By Yaali. November 2, 2026, 6 min read, Identity, Phishing, Threat intel.

MS-ISAC told 808 of 6,116 K-12 members their staff logins were on dark web markets. How account takeover hopping works and what districts should check.

During the 2025-26 school year, the Multi-State Information Sharing and Analysis Center (MS-ISAC) notified 808 of its 6,116 K-12 member organizations, about 13%, that staff accounts or credentials were circulating on underground marketplaces and dark web sources. The figure comes from The State of K-12 Cybersecurity 2026, published on October 27 by the Center for Internet Security (CIS), which runs MS-ISAC, with the Consortium for School Networking (CoSN).

The report names the pattern behind many of those logins "account takeover hopping": a phished account at one district is used to phish its contacts, including staff at other districts. MS-ISAC assesses with high confidence that it will continue through the 2026-27 school year. If you run email or identity for a school, a district, or a supplier that trades mail with them, the next phishing message you receive may come from a real account you already trust.

How account takeover hopping works

The first step is ordinary credential phishing. A staff member gets a message styled as Google or Microsoft, follows a link that often passes through a redirect on a legitimate site, and types their password into a fake sign-in page. The attacker now has a working mailbox at a school.

The second step is what makes the pattern hard to stop. The attacker sends the next round of phishing from that mailbox, to the people it already writes to: colleagues, vendors and staff at neighbouring districts. Those messages leave the real tenant through the real mail servers, so they pass SPF, DKIM and DMARC, the checks that confirm a message really came from the domain it claims. A filter that trusts authenticated mail from a known partner has no reason to stop them, and the recipient sees a familiar name in a thread that looks routine. Each new victim's mailbox feeds the next wave.

MS-ISAC investigations also found attackers using hijacked K-12 accounts to impersonate superintendents and other officials, target more staff and commit fraud. The report does not give the fraud amounts.

What else reached school devices

The same report shows how attacks start without email. Of 1,796 infections from the ten malware families seen most often at K-12 members, 1,159, about 65%, were linked to malvertising: malicious code injected into ads on legitimate websites. The ten families are SocGholish, FormBook, upStage, CoinMiner, Calendaromatic, VenomRAT, ZPHP, NanoCore, Agent Tesla and PureLogs.

Analysts logged 285 ClickFix findings, where a web page tells the user to paste and run a command to "fix" a problem, and 322 findings tied to TA2726, a traffic distribution service that sends visitors of compromised sites to fake software and browser update pages.

Once something ran, attackers worked to stay hidden. Across 2,707 incidents from MS-ISAC managed detection and response (MDR) on school endpoints, defense evasion appeared in 1,711, about 63%. Attempts to disable or modify security tools showed up in 881 incidents and process injection in 423. OS credential dumping appeared in 124 and unsecured credentials, such as passwords left in files or scripts, in 101.

The survey behind the numbers

CIS surveyed 426 school IT and security practitioners in August and September 2026. 87% named phishing or email compromise among their most common incidents, and 51% had an incident in the past 12 months. 83% report using multi-factor authentication (MFA). 66% have one or two people responsible for cybersecurity and 11% have none, so whatever follows has to be achievable by a very small team.

What to do

1. Act on any exposure notice. If MS-ISAC or another monitoring service reports a staff credential, reset the password and end the account's sessions, since a stolen session token survives a password change. In Microsoft 365, run Revoke-MgUserSignInSession -UserId <user> from Microsoft Graph PowerShell. In Google Workspace, go to Directory, Users, open the user, then Security, Sign-in cookies, Reset. If Google sign-in runs through a third-party SSO (single sign-on) provider, end the SSO session first, or the user stays signed in.
2. Look for what the attacker left behind. On each affected mailbox, list inbox rules (Get-InboxRule -Mailbox <user> in Exchange Online) and remove any that forward mail outside, or move it to RSS Feeds, Notes or Junk Email to hide replies. Check for MFA methods registered in the last few weeks and for third-party apps the user granted mail access to.
3. Trace the hop. Run a message trace for the compromised sender across the window it was exposed. Bursts to many external recipients, especially other districts, or messages with a link and almost no text, mean you have probably phished someone else. Tell those recipients directly and tell MS-ISAC, so the next district does not learn it from an attacker.
4. Harden sign-in for the accounts worth stealing. The report recommends phishing-resistant MFA, such as FIDO2 security keys or passkeys, which will not complete a sign-in on a fake page. Start with superintendents, finance, payroll, HR and IT admins, and review who holds privileged roles.
5. Verify money changes out of band. Since attackers impersonate superintendents from real accounts, require a call-back to a number already on file before changing vendor bank details, direct deposit or any payment a senior official asks for by email.
6. Cut the browser route. Use protective DNS, such as MS-ISAC's Malicious Domain Blocking and Reporting (MDBR) service or a resolver of your choice. Force-install an ad blocker through managed Chrome and Edge policy on staff devices and Chromebooks. On Windows, the Group Policy setting "Remove Run menu from Start Menu" (User Configuration, Administrative Templates, Start Menu and Taskbar) disables the Win+R dialog that ClickFix lures usually tell the user to open.
7. Watch your security tools. With 881 incidents involving attempts to disable or modify them, turn on your EDR (endpoint detection and response) tamper protection and alert when an agent stops reporting.

Trusted senders need checking too

Most school email filtering is built to catch mail from strangers. Account takeover hopping arrives from known partners over fully authenticated paths, so detection has to look at behaviour instead: a sender who suddenly writes to dozens of outside contacts, a sign-in from a new country followed by a burst of mail, or a link to a sign-in page in a thread that never needed one. Alerts on your own accounts sending unusually also catch the case where your district is the one doing the hopping.

Our security operations team builds the identity and mail detections this needs, and our safeguarding and hardening work sets up MFA, browser policy and EDR tamper protection for small IT teams. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: CIS, The State of K-12 Cybersecurity 2026 (full report), CIS, report page, CIS press release, Help Net Security, K-12 Dive, StateScoop, Microsoft Learn, determine if an account is compromised, Google Workspace, reset a user's password.