As reported by SecurityAffairs, researchers at Hudson Rock have linked two university email addresses associated with the November 11 bomb threat campaign that disrupted approximately 6,000 Italian schools — and spread to institutions in Northern Ireland, Scotland, and Ireland — to credentials previously stolen by infostealer malware.
What makes this finding significant is not that it identifies the perpetrator. Hudson Rock was careful to note that credential exposure proves only that these accounts were compromised at some point, not that their owners sent the threats. The real story is the broader pattern it exposes: infostealer-derived credentials remain a durable, low-cost resource for anyone seeking to conduct anonymous operations through hijacked accounts.
The Infostealer Economy as Enabler
The Egyptian university email address identified by Hudson Rock appeared in a Vidar infostealer export dated October 1, 2021 — over five years before the threat campaign. That export captured 112 saved credentials from a single infected Windows 7 machine, with 20 tied to the university address and two pointing to Microsoft sign-in pages. This illustrates a core problem: a single endpoint infection can cascade into dozens of compromised services when password reuse is prevalent.
The threat actor didn't need to hack the universities in November 2026. They needed the credentials to still be valid — or to find accounts where password rotation never happened.
Why This Matters Beyond the Headlines
Bomb hoaxes are devastating in operational impact regardless of their falseness. Italy's Prime Minister confirmed no devices were found, but schools evacuated, classes were disrupted, and law enforcement resources were consumed across multiple countries. The use of compromised legitimate email accounts — particularly .edu addresses — also increases the likelihood that threat emails bypass spam filters and appear credible to recipients.
This campaign pattern is not new, but it is escalating. Infostealer malware families like Vidar, Lumma, RedLine, and Raccoon have flooded criminal markets with billions of stolen credentials. Many remain viable because password hygiene across academic and consumer accounts remains poor, and MFA adoption in higher education lags behind enterprise sectors.
Who Is at Risk
- Higher education institutions — university accounts are high-value targets for credential theft due to implicit trust, broad access, and often inconsistent security controls
- Primary and secondary schools — recipients of threats sent through compromised accounts, with limited security staff to validate sender authenticity
- Any organization whose users reuse passwords across personal and institutional accounts, especially if those credentials appear in known infostealer datasets
Shield53 Recommendations
- Conduct credential exposure audits: Use services like Hudson Rock's Infostealer Intelligence, Have I Been Pwned, or commercial dark web monitoring to identify exposed credentials for all institutional email domains — not just current staff, but alumni, guest, and shared departmental accounts that may never have been rotated
- Enforce MFA on all email accounts: Require multi-factor authentication on every mailbox, especially shared accounts and distribution lists that may have been created years ago and forgotten
- Implement password rotation for exposed accounts: Any credential found in infostealer data should trigger an immediate forced password reset, regardless of how old the exposure record is
- Deploy email authentication hardening: Ensure SPF, DKIM, and DMARC are configured at enforcement (p=reject) to reduce the chance that spoofed or hijacked external .edu accounts can bypass filtering
- Establish threat-response playbooks for hoaxes: Schools and universities should have pre-coordinated protocols with local law enforcement so that bomb threats can be assessed rapidly without full evacuation as the default response, reducing the operational impact of mass hoax campaigns
- Monitor for infostealer infections on managed devices: Deploy EDR with infostealer detection rules covering Vidar, Lumma, RedLine, and similar families — the initial infection that led to credential theft may still be present on unmanaged or legacy machines
The November 2026 school threat campaign is a reminder that infostealer data is not just a ransomware precursor. It is a standalone enabler for disinformation, harassment, and disruption — and the shelf life of stolen credentials is measured in years, not weeks.
