Stolen .edu accounts spread fake job offers and gift card scamsVictims deposit fake $1,000 checks, then buy scammers gift cardsProofpoint linked operators to Nigeria through IP logging investigationsCybercriminals from Nigeria are targeting college students in the West with an advance fee fraud (AFF) scam tricking them into giving away hundreds of dollars. Security researchers Proofpoint discovered the campaign, which aims to get gullible students to buy gift cards with their own money and send them to the scammers. We don’t know how many people fell victim, or for how long the operation has been going, but Proofpoint believes it knows why the scammers are targeting primarily college students.What is the scam?“Younger students may have less experience with email correspondence and are new to engaging with potential work or money-making opportunities; alumni may still have active email accounts, but may not use them frequently, providing an opportunity for threat actors to hijack their contact lists; and staff and faculty are constantly receiving communications from students, parents, community members, etc. from a variety of personal and university emails,” the experts said. “By gaining access to a .edu account, threat actors can use the authority of the TLD to lend credibility to their scams both inside and outside of the target organization.”There are multiple stages to the scam. It starts with a phishing email to anyone with an .edu address, warning the victim that their email account is going to get deactivated because of a made-up excuse like retirement, graduation, or transfer. The lure asks the victim to “verify” their address, and while doing so, they are asked to share their passwords, as well.After gaining access to the account, the crooks use it to share a second phishing email, this time to students in the contacts list, as well as anyone else with an .edu address. This lure advertises a fake job for the students to apply to. Those that “get the job” are given a copy of a check for $1,000 and are told to deposit it. They are instructed to keep half as their salary, and to purchase gift cards with the other half, which they should then send back to the scammers.The checks are, obviously, fake, and by the time the bank discovers the scam, the victim will have already purchased the gift cards and sent them away. The bank then reverses the deposit, leaving the victim $500 short. Proofpoint’s researchers were “hired” for one of these jobs, which is how they uncovered the entire modus operandi. They also learned that if the victim doesn’t follow through with the instructions, they will become aggressive, suggesting different payment services, and even call the victim on the phone, pretending to be an FBI agent threatening legal action and arrest.Nigerian operationAttributing the scam to any particular group is rather difficult, the researchers said. They did, however, manage to trick the fraudsters into using Grabify, an IP logging and URL shortening service usually used by online marketers. The links are used to extract things like device information and IP addresses from whoever clicks them, and Proofpoint’s researchers found the engagement coming from Nigeria.While there are ways to hide one’s IP address, Proofpoint is rather confident about the location of this particular operation.“While it is possible for threat actors to spoof their infrastructure, based on our investigations from hundreds of engagements, these AFF fraudsters typically use their real mobile network infrastructure to conduct their crimes. Even if the scammers do use a VPN, they often still click on researchers’ links from their genuine devices due to the multi-platform communication style they use (and the desire to monetize, despite possible deanonymization),” Proofpoint concluded.