A Classroom Campaign Turns Malicious

Between August 6 and 12, 2025, threat actors launched a large phishing campaign that posed as Google Classroom invitations. They sent 115,000 emails in five coordinated waves. The attack bypassed standard filters by taking advantage of the platform’s trusted image. Over 13,500 institutions across North America, Europe, the Middle East, and Asia were targeted.

Why the Campaign Was So Dangerous

Inherent Trust in Classroom Messages

Messages from Google Classroom often avoid security filters. Attackers used this to deliver phishing emails to inboxes before defenses could respond.

Lures Disguised as Educational Invitations

These emails offered unrelated services such as SEO, product pitches, and other commercial deals designed to distract recipients.

Off-Channel Redirection

Recipients were instructed to contact the attackers via WhatsApp. This tactic moves the conversation away from enterprise monitoring into a harder-to-trace environment.

Lessons for IT Leaders

1. Question Every Unexpected Invite Train users to be cautious of classroom invites, especially those promoting business services or redirecting communications.
2. Enforce Multi-Layered Security Stop deceptive emails from reaching inboxes or bypassing filters by using layered defenses, including email authentication, AI-based filtering, and behavior monitoring.
3. Scope Security Beyond Email Provide protection in collaboration platforms. Phishing threats now exist across cloud services and SaaS tools, not just in traditional email.

How to Supports Defenses Without Adding Friction

While classroom-based phishing serves as a warning, the incident highlights the importance of invisible safeguards. Skysnag protects the integrity of your sending domains, ensuring that SPF, DKIM, and DMARC standards are met. This makes it harder for phishing campaigns to pose as trusted classroom invitations.

If a malicious actor tries to impersonate a school system domain, solid authentication makes it difficult to spoof successfully. Skysnag helps ensure that only legitimate messages go through, maintaining trust without disrupting user experience in real-time.

Defense Checklist

Protect Your Organization Today

Phishing threats now disguise themselves within trusted platforms like Google Classroom. To safeguard your enterprise, start strengthening your domain authentication today. Explore Skysnag to implement seamless, automated defenses that make spoofing much less effective.