The UK government’s latest cybersecurity survey found that 79% of higher education institutions reported impersonation attempts in the past year, compared to 28% of businesses. The gap reflects something structural about how universities operate, and the campaigns exploiting it are growing more sophisticated.
When the UK Department for Science, Innovation and Technology published its Cyber Security Breaches Survey for 2025/2026 in April 2026, the headline finding was that 91% of higher education institutions had experienced a cyberattack or breach in the previous twelve months. Within that figure, the impersonation data stood out. Seventy-nine percent of further and higher education institutions reported being targeted by impersonation attempts, compared to 28% of businesses, a ratio of nearly three to one. The gap extended across every other category as well: malware and spyware affected 51% of universities versus 16% of businesses, and denial-of-service attacks hit 49% versus 13%. Among institutions that identified a breach, nearly half suffered negative outcomes, with 23% reporting that compromised accounts had been used for illicit purposes.
The disparity is not random. It reflects a set of characteristics that define the higher education environment: a trusted institutional brand that touches nearly every aspect of campus life, a large and transient population with uneven security awareness, an open network architecture that prioritizes access over restriction, and security resources that rarely match the scale of the attack surface. Understanding why the rate is what it is, and what the campaigns targeting universities actually look like, is the starting point for any institutional response.
What the campaigns actually look like
The abstract statistics become concrete in the campaigns that produce them, and two from the past twelve months illustrate how brand impersonation plays out in the university environment.
Between April and November 2025, SC Media reported on an adversary-in-the-middle campaign that targeted 18 US universities using the open-source phishing kit Evilginx. The attackers sent personalized emails containing TinyURL-shortened links that directed recipients to pages mimicking each university’s single sign-on portal. When a user logged in, Evilginx relayed the credentials to the real authentication service in real time, captured the session cookie minted after MFA completed, and handed the attacker a fully authenticated session. This is a variant of the adversary-in-the-middle technique that has become one of the most effective methods for defeating standard MFA across every sector. The universities of California at Santa Cruz and Santa Barbara, the University of San Diego, Virginia Commonwealth University, and the University of Michigan were among the most heavily targeted. Infoblox’s DNS pattern analysis eventually identified nearly 70 attacker-controlled domains, each built to replicate a specific institution’s login experience. MFA was in place. It did not matter, because the attacker was not bypassing authentication. They were sitting between the user and the service, collecting the output.
A separate campaign documented by Microsoft’s security team showed what happens after the initial compromise. Beginning in March 2025, attackers used 11 compromised accounts at three universities to send phishing emails to nearly 6,000 accounts across 25 additional institutions. The objective was not data exfiltration. It was payroll redirection: the attackers targeted Workday profiles to change direct deposit information, routing paychecks to accounts they controlled. Microsoft was careful to note that the campaign exploited the absence of phishing-resistant MFA rather than any vulnerability in the Workday platform itself. The attack worked because the university’s brand, delivered through a compromised university email account, was sufficient to persuade recipients to enter credentials on a page that looked exactly like the one they used every day.
Why the impersonation rate is so high
The three-to-one ratio is not a mystery once you examine what universities expose to the internet and how their brands function in the daily lives of their communities.
A university’s brand carries authority across an unusually wide range of interactions: enrollment, financial aid, tuition payments, payroll, research funding, benefits administration, housing, parking, campus health, and technology services. Each of these is a plausible pretext for a social engineering message. The Evilginx campaign used SSO login lures. The payroll pirate campaign used benefits and direct-deposit lures. Other documented campaigns have used tuition refund notices, parking fine alerts, and financial aid disbursement warnings. The diversity of legitimate communications a university sends to its community creates a correspondingly diverse set of lures an attacker can imitate.
The population is large, transient, and unevenly security-aware. A university might have 50,000 active accounts spanning students, faculty, researchers, administrative staff, and contractors, with a significant portion turning over every year. New students arrive expecting unfamiliar communications from unfamiliar systems. Departing faculty leave behind accounts that may persist well beyond their last login. The attack surface is not a fixed perimeter but a constantly shifting population that expects to be contacted by the institution and trusts the brand when it appears.
And the security teams tasked with defending this environment typically operate with a fraction of the budget and staffing that a comparably sized financial institution or technology company would dedicate to the same problem. The UK survey data confirms this: universities reported significantly higher attack rates across every category while also reporting lower rates of formal incident response planning and board-level engagement with cybersecurity.
What university security teams should be watching
The Evilginx and Payroll Pirates campaigns share a pattern that points toward where the monitoring effort needs to focus.
Both campaigns depended on convincing replicas of university-branded login pages, either through cloned SSO portals or through compromised email accounts that carried the institution’s name as their trust signal. This means the impersonation is visible from outside the network before a single user clicks anything. The attacker-controlled domains that mimicked university SSO portals were registered days to weeks in advance. The phishing pages carried the institution’s visual branding and URL structure. For institutions that monitor for unauthorized use of their name in newly registered domains and phishing infrastructure, this is a window to act before the campaign reaches its intended recipients.
Phishing-resistant MFA (FIDO2/WebAuthn, passkeys) is the authentication control that would have disrupted both campaigns. Standard MFA with push notifications or SMS codes did not prevent the Evilginx session hijacking, because the relay captured the session cookie after authentication completed. Microsoft’s analysis of the payroll pirate campaign specifically attributed the compromise to the absence of phishing-resistant MFA rather than any platform vulnerability. For institutions still relying on standard MFA, the UK survey data and these two campaigns make the case that the upgrade is not theoretical.
And the compromised-account-as-propagation-tool pattern documented in the Payroll Pirates campaign, where 11 compromised accounts at three institutions were used to phish 25 others, means that an impersonation incident at one university can become a brand impersonation incident at dozens of peer institutions. Monitoring for your institution’s name in phishing campaigns is not just a defensive measure for your own community but a responsibility to the broader higher education ecosystem that trusts communications bearing your brand.
The Bottom Line
Higher education institutions are impersonated at nearly three times the rate of businesses, according to the UK government’s 2025/2026 cybersecurity survey, and the campaigns driving that statistic are not crude. They use adversary-in-the-middle relays that capture session cookies past MFA, compromised accounts that propagate across peer institutions, and payroll redirection schemes that convert a single compromised credential into direct financial theft. The structural characteristics of university environments, a brand that touches every aspect of campus life, a population that turns over every year, and security budgets that do not match the exposure, make them disproportionately attractive to attackers who have learned to exploit institutional trust. For university security teams, the 79% figure is not a statistic about someone else. It is the operating environment.
Key Takeaways
The UK government’s Cyber Security Breaches Survey for 2025/2026 found that 79% of higher education institutions reported impersonation attempts in the past year, compared to 28% of businesses, a ratio of nearly three to one.
An Evilginx campaign targeting 18 US universities between April and November 2025 used adversary-in-the-middle techniques to capture session cookies after MFA, using nearly 70 domains that replicated university SSO portals. A separate “payroll pirate” campaign documented by Microsoft used compromised university accounts to phish 6,000 accounts across 25 institutions, targeting payroll systems to redirect direct deposits.
Universities have trusted brands that span an unusually wide range of interactions (enrollment, financial aid, payroll, housing, parking, health services), large and transient populations with uneven security awareness, and security budgets that do not match the scale of the attack surface they present.
Phishing-resistant MFA (FIDO2/WebAuthn, passkeys) is the authentication control that would have disrupted both the Evilginx and Payroll Pirates campaigns. Monitoring for unauthorized use of the institution’s brand in newly registered domains and phishing infrastructure provides a window to act before campaigns reach their intended recipients.
The Payroll Pirates campaign used 11 compromised accounts at three institutions to phish 6,000 accounts across 25 others. A compromised university email account carries enough institutional authority to be trusted by peer institutions, which means an impersonation incident at one university can propagate across the broader higher education ecosystem.
