Nigerian scammers target students with fake job offers

Cybercriminals operating from Nigeria have launched an advance fee fraud scam targeting college students in Western countries. Security researchers at Proofpoint uncovered the operation, which leverages compromised .edu email accounts to distribute fraudulent job offers. The scam begins with a phishing email, tricking victims into sharing their passwords under the guise of account deactivation. Once a .edu account is compromised, threat actors send further phishing emails advertising fake job opportunities to contacts and other .edu users.

Successful applicants receive a fake $1,000 check, with instructions to deposit it. Victims are told to retain half the amount as salary and purchase gift cards with the remaining $500 to send to the scammers. By the time the fraudulent nature of the check is discovered, victims have already lost their money. Proofpoint researchers, posing as applicants, uncovered the full modus operandi and noted aggressive tactics, including threats and impersonation of law enforcement if victims did not comply.

Investigations, including IP logging via Grabify, suggest the operation originates from Nigeria. While acknowledging the possibility of spoofing, Proofpoint is confident in the attribution due to the typical infrastructure used by these advance fee fraud operators. This scam highlights the persistent threat of online fraud targeting vulnerable student populations.