False Allegations, Real Threats: Sexual Misconduct Claims Used as Phishing Lures
Phishing campaign impersonating university leadership delivers Zoho Assist RAT via Google Drive redirects, targeting healthcare-affiliated universities with fabricated sexual misconduct claims. Threat actors spoof university presidents and deans in phishing emails alleging sexual misconduct, directing victims to Google Drive files that link to Zoho Assist RAT downloads. Over 80% of targets are healthcare-related universities. The campaign bypasses Integrated Cloud Email Security controls using Google Drive as an intermediary and newly registered domains for payload hosting.
Detection / Hunteropenrouter
Immediate Actions
- Block the identified Google Drive URL and ZA_Access_My_Department.exe filename
- Alert on Zoho Assist installations originating from email link clicks
- Block newly registered domains less than 30 days old serving executable downloads
Key Takeaways
- Zoho Assist RAT delivered in all campaign instances via Google Drive redirect chain
- Over 80% of targeted organizations are healthcare-affiliated universities
- Threat actor-controlled domains used for hosting are typically less than one month old
- Email explicitly instructs victims to download and install Zoho Assist
- Campaign uses a shared template with minimal variation between phishing emails
Attack Chain
- Initial Access: Phishing email impersonates university leadership alleging sexual misconduct violation
- Execution: Victim clicks embedded link redirecting to Google Drive file
- Defense Evasion: Google Drive intermediary obfuscates payload download from email security
- Installation: Victim downloads Zoho Assist RAT from cloud service or newly registered domain
- Command and Control: Zoho RAT enables screen viewing, file transfer, and secondary payload delivery
Affected Systems
- Windows endpoints (executable payload)
- Healthcare-affiliated university staff
- University employees handling Title IX matters
- Medical colleges and teaching hospitals
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Zoho Assist is legitimate software; installation may not trigger EDR alerts without behavioral context. |
| Network Visibility | Medium | Google Drive traffic is common; newly registered domains for payload hosting may be flaggable. |
| Detection Difficulty | Hard | Abuse of legitimate remote access tools and Google Drive makes signature-based detection ineffective. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Zoho Assist installation events preceded by Google Drive or newly registered domain access from email link clicks (T1219, T1566.002) | EDR process logs, web proxy logs | Execution | Medium — Zoho Assist has legitimate administrative uses |
| Inbound emails from external university domains containing sexual misconduct subject lines with embedded links (T1566.002) | Email gateway logs, SEG logs | Initial Access | Low — subject matter is unusual for routine university communications |
| Executable downloads from domains registered within the past 30 days following email link clicks (T1219, T1204.002) | DNS logs, web proxy logs, WHOIS data | Installation | Medium — newly registered domains also serve legitimate purposes |
Required Log Sources
- Email gateway logs
- Web proxy logs
- EDR process execution logs
- DNS resolution logs
- URL filtering logs
Key Behavioral Indicators
- Zoho Assist process spawned after email link click chain
- Executable named ZA_Access_My_Department.exe downloaded from web
- Google Drive redirect to external domain for executable download
- Email sender domain mismatch with claimed university affiliation
- Email instructing recipient to install software to view document
- Newly registered domains serving executable files
Control Gaps
- ICES email security controls bypassed by Google Drive intermediary
- Signature-based AV cannot distinguish legitimate Zoho Assist from abused instances
- URL filtering may allow Google Drive links by default
- Domain age-based blocking not universally enforced
False Positive Assessment
Medium — Zoho Assist is a legitimate remote support tool with routine administrative uses; Google Drive links are common in business communications.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Configure email security to flag emails instructing software installation for document access
- Implement URL rewriting and time-of-click protection for Google Drive links in emails
- Restrict Zoho Assist execution to approved administrative contexts only
User Protection
- Warn staff that emails requiring software installation to view documents are phishing indicators
- Instruct staff to verify university misconduct claims through independent channels before acting
- Deploy endpoint controls that alert on RAT installation from untrusted sources
Security Awareness
- Train staff to recognize that legitimate documents do not require installing new programs
- Advise staff to contact legal department to verify cross-institutional misconduct notifications
MITRE ATT&CK Mapping
Initial Access
Execution
Stealth
Command and Control
Plain-Language Summary
Attackers are sending fake emails that appear to come from university presidents or deans, claiming a sexual misconduct incident has occurred. The emails link to a Google Drive document, which then leads to downloading a remote access program called Zoho Assist. Once installed, this program lets attackers control the victim's computer, view files, and potentially deploy ransomware. Healthcare-related universities are the primary targets. Staff should be suspicious of any email requiring them to install new software to view a document.
Additional IOCs
- File Paths:
Medical College of Wisconsin_Employee_Misconduct_Report_Alleged_Sexual_Harassment_.docm- Google Drive document name used as phishing lure
- filenameMedicalCollegeofWisconsin_Employee_Misconduct_Report_Alleged_Sexual_Harassment_.docmGoogle Drive document name used as phishing lure
- filenameZA_Access_My_Department.exeMalicious Zoho Assist RAT executable delivered to victims