Higher Education Cybersecurity Solutions & Training

Starting around 2013, operators affiliated with a Tehran-based company called the Mabna Institute sent spear-phishing emails to more than 100,000 university professors around the world. According to the US indictment unsealed in March 2018, about 8,000 accounts were compromised at 144 universities in the US and 176 universities in 21 other countries, and more than 31 terabytes of academic data and intellectual property were stolen.

Proofpoint researchers found that most lures were themed around library access and led to convincing clones of university library and portal login pages. The campaigns continued after the indictment.

The page they landed on carried their own university's name, colors, and layout. Nothing about it looked foreign, because it was built to be a copy, and nothing about the request looked unusual, because renewing access to the library is something a researcher does several times a year without a second thought. The lure did not try to alarm anyone. It slipped a login prompt into a routine the person already trusted.

That is what made it effective. Faculty members log into portals constantly, and the habit of typing a password into a familiar-looking screen is so well practiced that it runs below the level of conscious attention. The attackers borrowed the institution's own identity, and the people who fell for it were not careless. They were doing exactly what they do every working day.

Faculty need to see a cloned login page before an attacker shows them one. Whitebait runs credential harvesting simulations, and Dolus AI Studio can rebuild a real phishing email that reached your staff from a screenshot, so simulations mirror the lures already arriving on your campus.

Not every account carries the same risk. Odin includes role, privileges, and criticality in each score, so researchers with access to sensitive data or valuable intellectual property are weighted accordingly, and risk can be compared across faculties and administrative units.

Fraus measures how many staff report a simulated lure as well as how many click it, which shows whether people are flagging suspicious messages and not only avoiding them. Codex delivers training in English and Arabic for the international academic communities common across UAE and GCC campuses, including modules on Shadow AI and GenAI risk for research teams adopting new tools.