Table of Contents
Infostealers are one of the most critical threat vectors challenging modern networks, with higher education institutions one of the main targets.
Universities have fluid, decentralized perimeters shaped by widely dispersed student populations and extensive Bring-Your-Own-Device (BYOD) policies.
Within these open-network ecosystems, infostealer payloads are used as automated harvesting engines, extracting active session tokens, browser-vaulted credentials, and Single Sign-On (SSO) artifacts to enable Multi-Factor Authentication (MFA) bypass. They harvest from unmanaged, student-owned and institutional endpoints alike.
Quick Facts: Infostealers in Higher Education
|
What Is the Scope of the Infostealer Campaign in Dominican Universities?
Threat telemetry data reveals a sustained, multi-year credential-harvesting campaign systematically targeting the Dominican Republic’s higher education sector.
Threat telemetry obtained by Lumu’s Cyber Threat Intelligence (CTI) team demonstrates that compromised assets provide adversaries with authenticated footholds, enabling them to bypass traditional boundary defenses without needing software vulnerabilities.
Over at least the past six years, Dominican universities have accounted for at least 245,554 compromised credentials harvested across 50,636 infected endpoints. This operational tempo has remained aggressive into 2026, which has already registered upwards of 13,685 stolen credentials extracted from more than 3,541 unique compromised machines.
This underscores the importance of an active response to persistent threat actor activity within academic environments.
What Was the UNAPEC Credential Exposure Incident?
The October 2026 Universidad APEC (UNAPEC) incident was a major credential exposure event where infostealers executed covertly on unmanaged student BYOD devices rather than compromising core server infrastructure.
Coordinated containment efforts alongside the Dominican Republic’s National Cybersecurity Center (CNCS) and CSIRT-RD confirmed that the incident originated across these unmanaged student devices rather than core server assets.
This incident reflects a broader structural shift across Latin America and the Caribbean. Exfiltrated academic credentials are routinely supplying an underground market dominated by Initial Access Brokers (IABs) and Ransomware-as-a-Service (RaaS) cartels.
This converts decentralized edge infections, such as the student devices, into viable access vectors for downstream network intrusions.
A detailed breakdown of the Initial Access Broker (IAB) market and its economic drivers is available in our technical blog post: Infostealers: The Silent Threat Compromising the World.
How Do Pass-the-Cookie Attacks Bypass Multi-Factor Authentication?
Session hijacking attacks, also known as pass-the-cookie attacks, hijack active post-authentication session cookies to mirror a victim’s client fingerprint in anti-detect browsers, completely bypassing Multi-Factor Authentication (MFA) without needing primary credentials.
Telemetry from 2026 alone revealed at least 24,644 active session cookies exposed across Dominican academic institutions. Because session cookies represent post-authentication states, threat actors do not need to solve primary authentication or MFA challenges. By importing these stolen cookies alongside harvested hardware and network telemetry into anti-detect browsers, adversaries closely replicate the victim’s client fingerprint.
As a result, standard session-validation checks on institutional platforms fail to distinguish between the legitimate user and the attacker, granting threat actors unrestricted access to internal academic and administrative portals.
How Has Infostealer Malware Evolved Following the RedLine Takedown?
Following the Operation Magnus infrastructure disruption, threat actors transitioned to modular strains like Vidar, Acreed, and cracked legacy RedLine builds that evade traditional AntiVirus (AV) and Endpoint Detection and Response (EDR) solutions.
RedLine had established itself as the main infostealer variant targeting the Dominican academic sector. It was responsible for approximately 98,180 compromised accounts. However, in late October 2024, an international law-enforcement coalition disrupted RedLine’s core infrastructure under Operation Magnus, seizing central command-and-control (C2) servers and indicting developer Maxim Rudometov.
Despite this takedown, the operational ecosystem that RedLine pioneered persisted. Threat actors operating across Latin America and the Caribbean rapidly adapted by transitioning to modular successor strains. Modular means that the software can be adapted to different uses. They continued to deploy these unmanaged, cracked legacy builds of RedLine that remain functional without centralized developer support.
Historical data
The main variations were categorized as Generic, Vidar, and Acreed.
2026 variation
The expanding Initial Access Broker (IAB) economy increasingly undermines conventional host and perimeter defenses. Data from 2026 indicates that at least 48.7% of infostealer infections occurred on systems with active antimalware solutions installed.
This shows that evasion of AntiVirus and EDR solutions are standard operational realities rather than edge cases.
This evasion capability presents a challenge for higher education institutions with a Bring-Your-Own-Device (BYOD) policy for students and staff. They lack the administrative authority to enforce device posture, patch compliance, or security agents across student-owned hardware.
As a result, compromises on unmanaged BYOD endpoints occur entirely outside institutional visibility.
In 2026, malwareless attack trends expanded into the infostealer space. This is a notable shift, given that infostealers already account for 15% of all malware-driven attacks. Within these malwareless intrusions, the most observed techniques were Living-off-the-Land Binaries (LoLBins) and supply chain compromises.
What Is the Blast Radius of Infostealer Compromises in Higher Education?
Infostealer blast radius extends beyond student accounts to high-value administrative credentials, network controls, and IT systems accessed from unmanaged devices without requiring lateral movement.
The compromise data indicates that these high-value administrative accounts are being systematically harvested via identical stealer payloads. This includes multiple operational categories, including network infrastructure management, remote access services, and administrative control panels.
This cross-contamination reveals that administrative and IT personnel frequently access core resources from unmanaged endpoints. In doing so, they expose high-privilege access vectors to threat actors meaning that attackers no longer require lateral movement or privilege escalation.
The following dataset details the distribution of compromised privileged credentials observed across the analyzed Dominican universities during 2026:
Lumu’s research team uses Discover (Lumu’s external surface risk assessment tool) data to map how Dominican universities have been affected by infostealers in 2026.
How Do Threat Actors Monetize Stolen Academic Credentials?
Stolen credentials are sold on underground Initial Access Broker (IAB) marketplaces to Ransomware-as-a-Service (RaaS) affiliates like Rhysida to execute downstream enterprise intrusions.
The IAB market is decentralized and dynamic, characterized by illicit marketplaces, underground forums, and private channels that allow threat actors to mask their operational identities.
Within this pipeline, infostealer infections represent the critical first stage of multi-stage intrusions, providing the initial access credentials later monetized and operationalized by ransomware groups.
Although specific threat actors like Rhysida have demonstrated a historical operational focus on Caribbean organizations, commodified IAB listings remain accessible to any affiliate across the Ransomware-as-a-Service (RaaS) ecosystem, lowering the barrier to entry for opportunistic compromises.
How Can Higher Education Institutions Protect Against Infostealers?
Institutions must assume compromise, expand visibility to unmanaged BYOD endpoints, and automatically revoke exposed high-risk administrative accounts and active session tokens.
As identity becomes the modern security perimeter, institutions in the higher education sector must strengthen visibility not only within their internal networks, which remains necessary, but also across the fluid, unmanaged attack surface that falls outside institutional administrative control.
Proactively acting on accounts identified as high-risk, such as exposed administrative logins or active session tokens, enables security teams to intercept the early precursors of sophisticated intrusion chains before adversaries can escalate access.
Arrange a quick call with Lumu to find out what we can offer your education establishment. Just fill in your details at the bottom of our Education Homepage and we will get in touch.
Share this post