- Comparitech Stack Report
- Posts
- Evilginx-Style Phishing Campaign Hits U.S. Universities
Evilginx-Style Phishing Campaign Hits U.S. Universities
Taylor Hawes
December 10, 2025
From the Editor’s Desk
This week, rising third-party risk and a global push toward improved cyber defenses stand out. As organizations gear up for 2026 with bigger cyber-security budgets, one question emerges - are companies finally treating cyber resilience not as an option, but as a core part of business continuity?
🔎 Deep Brief
Evilginx-Style Phishing Campaign Hits U.S. Universities
A new campaign targeting U.S. universities has turned heads: attackers are using an advanced phishing tool (an Evilginx-style framework) to spoof single-sign-on (SSO) portals and grab credentials from students and staff. Since April 2025, at least 18 educational institutions have been targeted. What’s dangerous: the phishing URLs expire after 24 hours, making detection difficult, and the malware proxies legitimate login flows, often bypassing multi-factor authentication (MFA).
Overlooked due to a belief that universities are low-value targets, these attacks show that credential harvesting is now highly automated and stealthy. Attackers don’t need zero-day exploits, just a believable spoof, timely phishing link, and weak MFA defenses.
Takeaway
Institutions handling large user bases must treat identity infrastructure as high-risk. Strong MFA, SSO hardening, regular phishing-resistance testing, and user awareness are essential.
🧠 Strategy in Action
Growing Cyber-Risk Investments Reshape the 2026 Insurance Market
According to a recent report by Marsh, companies worldwide are planning steep increases in cybersecurity spending in 2026, driven by rising third-party risks and persistent ransomware threats.
Insurance firms are responding: cyber-insurance premiums are rising globally, and are expected to reach about $16.4 billion in 2026. Firms that improve security posture through tighter controls, incident-response planning, and risk audits are more likely to get favourable insurance terms.
Takeaways:
This shift shows that cyber-security is now being treated as a board-level concern. Investing in prevention and compliance isn’t just about protection. It affects insurance costs, liability, and long-term viability in a volatile threat landscape.
🕵️ Threat Actor Spotlight
Equation Group
The Equation Group is a long-standing cyber threat actor known for high-sophistication hacking campaigns, including custom backdoors, zero-day exploits, and deep-cover spyware.
They’ve targeted governments, critical infrastructure, and high-value enterprises, often operating under the radar for years. Their toolkit includes stealthy rootkits, encrypted command-and-control channels, and multi-stage infection paths designed to avoid detection.
For defenders, Equation Group represents a worst-case benchmark: a unit that combines technical excellence, operational patience, and a broad target scope. Preparing for threats like this means investing in deep visibility, behavioural detection, and layered defence, not just perimeter controls.
🛠️ Tool Check
Why Application Whitelisting Remains a Strong Defensive Layer
Application whitelisting, where only approved, signed applications are allowed to run, is a powerful way to block unknown malware and limit damage from zero-day or social-engineering attacks. This guide outlines how whitelisting fits into a layered security model and highlights several mature tools for endpoint protection.
Compared to traditional blacklisting (blocking known bad apps), whitelisting inverts the model: by default, nothing runs unless explicitly allowed. This reduces attack surface substantially, especially in environments where users don’t need administrative privileges. Deploying whitelisting can drastically reduce risk from ransomware, phishing-related malware, and supply-chain threats.
🗣️ Community Signal
While AI and machine learning offer significant potential to enhance cybersecurity, they are not a panacea. These technologies can be used to automate routine tasks, detect anomalies, and respond to threats more quickly. However, they must be complemented by human expertise to ensure effective decision-making and ethical considerations. Matt Murrisky
📚 Don’t Miss This
|
Until Friday’s edition - Let’s keep that zero-day count at zero!