Spear phishers target US students

Researchers at Sans Institute said that the attacks are disguised as messages from administrators performing a 'database update'.

The messages state that in order to keep their email accounts, the students must 'verify' the accounts by replying to the message with details such as user names, passwords and date of birth.

Researcher Mark Hofman wrote in the Internet Storm Center blog that the attacks are similar to those on European ISPs spotted earlier this year.

The attackers use email addresses with the name of the school, although the accounts are hosted by an external email service such as Hotmail.

Hofman noted that, because the attack targets individual students, few messages are sent and the emails will often slip past spam filters.

Administrators should be on the lookout for a large volume of incoming messages from the same address, as well as a large volume of messages with multiple recipients. Students should also be warned about the attacks.