Italian School Bomb Threats Linked to Stolen Credentials
Threat actors used long-compromised university email accounts to bypass security filters and cause disruption.
1Widespread School Disruptions
Over 6,000 schools across Italy faced significant operational disruptions this week due to a series of bomb threats. These threats were sent using official university email addresses, which initially suggested a sophisticated infrastructure breach. However, investigations revealed that the accounts were hijacked using long-exposed credentials rather than a direct system hack.
2Credential Theft Origins
Hudson Rock identified two specific university email addresses used to send the threats, originating from Egypt and Taiwan. Analysis of their stolen-credential database confirmed that both accounts were compromised years prior to the incident. These accounts were used to bypass outbound spam filters, effectively weaponizing legitimate identities to cause public chaos.
3Egyptian Account Infection
The Egyptian university account was traced back to a Vidar malware infection occurring on October 1, 2021. Logs indicate that the malware successfully extracted 112 credential records directly from the Google Chrome browser. This included sensitive passwords saved against Microsoft authentication pages, providing attackers with persistent access to the institutional email system.
4Taiwanese Account Exposure
The Taiwanese university account was identified through the historical AlienTXTBASE collection. Records show a matching Microsoft URL-login-password entry that dates the exposure to more than a year before the November 2026 threats. This long-term access allowed threat actors to maintain a dormant presence until they decided to launch the disruptive campaign.
5Bypassing Security Filters
By utilizing legitimate, albeit compromised, university accounts, the attackers successfully bypassed standard outbound spam filters. Security systems often trust institutional domains, making them ideal vehicles for malicious activity. This method demonstrates how threat actors leverage existing, unremediated identities to conduct large-scale operations without needing to deploy new, complex malware infrastructure.
6Public Safety Implications
This incident highlights that unresolved credential theft is a critical public safety issue rather than just a private data theft concern. When institutional identities remain compromised, they become vehicles for impersonation and widespread disruption. The ability to cause mass panic using stolen credentials underscores the urgent need for proactive identity management.
7Need for Exposure Intelligence
Organizations must integrate exposure intelligence into their security protocols to identify compromised credentials before they are exploited. The failure to kill active sessions and reset passwords early allowed these attackers to maintain access for years. Continuous monitoring of credential leaks is essential to prevent the weaponization of institutional email accounts.
8Future Security Outlook
The Italian school threats serve as a case study for the risks posed by legacy credential exposure. As threat actors increasingly rely on hijacking existing identities, organizations must prioritize rapid remediation cycles. Future security strategies must focus on identifying and neutralizing these long-exposed accounts to prevent similar large-scale public disruptions.
Original article: cybersecurity — Italian School Bomb Threats Linked to Stolen Credentials