--- title: Unmasking a Sophisticated Phishing Campaign against K12 Schools description: Deep dive into a phishing campaign targeting K12 schools, abusing Azure and phone scams with advanced tracking. image: https://blog.identityautomation.com/hubfs/shutterstock_2577893447.jpg --- [Skip to content](https://blog.identityautomation.com/unmasking-phishing-campaign-k12-schools#main-content) [Identity Automation is now part of Jamf. Visit Jamf.com](https://jamf.com/) - [Request a Demo](https://www.identityautomation.com/request-a-demo) - [Contact Us](https://www.identityautomation.com/contact) [![IA-a-Jamf-Company\_horizontal-lightmode@908x148](https://blog.identityautomation.com/hs-fs/hubfs/IA-a-Jamf-Company_horizontal-lightmode@908x148.png?width=461&height=75&name=IA-a-Jamf-Company_horizontal-lightmode@908x148.png "IA-a-Jamf-Company_horizontal-lightmode@908x148")](https://www.identityautomation.com) Menu - Products Show submenu for Products - Identity Solutions Show submenu for Identity Solutions - [Identity Lifecycle Management](https://www.identityautomation.com/products/identity-lifecycle-management/) - [Access Governance](https://www.identityautomation.com/products/access-governance) - [Authentication](https://www.identityautomation.com/products/authentication) - [Threat Detection & Response](https://www.identityautomation.com/products/threat-detection-and-response) - [FusionID](https://www.identityautomation.com/fusionid) - Classroom Solutions Show submenu for Classroom Solutions - [Student-Teacher Portal](https://www.identityautomation.com/products/student-teacher-portal) - [Rostering](https://www.identityautomation.com/products/rostering) - [Insights](https://www.identityautomation.com/products/insights) - Industries Show submenu for Industries - [K-12](https://www.identityautomation.com/industries/k-12-education) - [Higher Ed](https://www.identityautomation.com/industries/higher-ed) - [Healthcare](https://www.identityautomation.com/industries/healthcare) - Resources Show submenu for Resources - [Knowledge Base](https://blog.identityautomation.com/) - [PhishWire](https://blog.identityautomation.com/phish-wire) - [Events](https://www.identityautomation.com/resources/events) - [Support](https://help.rapididentity.com/) - [Trust Center](https://www.identityautomation.com/trust-center) - [SSO & Rostering Integrations](https://www.identityautomation.com/sso-rostering-integration) - [About Us](https://www.identityautomation.com/about-us) Show submenu for About Us - [Why IA?](https://www.identityautomation.com/why-ia) - [Careers](https://www.jamf.com/about/careers/) - Products Show submenu for Products - Identity Solutions Show submenu for Identity Solutions - [Identity Lifecycle Management](https://www.identityautomation.com/products/identity-lifecycle-management/) - [Access Governance](https://www.identityautomation.com/products/access-governance) - [Authentication](https://www.identityautomation.com/products/authentication) - [Threat Detection & Response](https://www.identityautomation.com/products/threat-detection-and-response) - [FusionID](https://www.identityautomation.com/fusionid) - Classroom Solutions Show submenu for Classroom Solutions - [Student-Teacher Portal](https://www.identityautomation.com/products/student-teacher-portal) - [Rostering](https://www.identityautomation.com/products/rostering) - [Insights](https://www.identityautomation.com/products/insights) - Industries Show submenu for Industries - [K-12](https://www.identityautomation.com/industries/k-12-education) - [Higher Ed](https://www.identityautomation.com/industries/higher-ed) - [Healthcare](https://www.identityautomation.com/industries/healthcare) - Resources Show submenu for Resources - [Knowledge Base](https://blog.identityautomation.com/) - [PhishWire](https://blog.identityautomation.com/phish-wire) - [Events](https://www.identityautomation.com/resources/events) - [Support](https://help.rapididentity.com/) - [Trust Center](https://www.identityautomation.com/trust-center) - [SSO & Rostering Integrations](https://www.identityautomation.com/sso-rostering-integration) - [About Us](https://www.identityautomation.com/about-us) Show submenu for About Us - [Why IA?](https://www.identityautomation.com/why-ia) - [Careers](https://www.jamf.com/about/careers/) # Unmasking a Sophisticated Phishing Campaign against K12 Schools [by Identity Automation](https://blog.identityautomation.com/author/identity-automation) ![](https://blog.identityautomation.com/hubfs/shutterstock_2577893447.jpg) A deep-dive investigation into a multi-tier threat actor ecosystem operating one of the longest-running phishing campaigns targeting K12 schools. We uncovered a sophisticated phishing campaign abusing Azure Blob Storage infrastructure to impersonate Microsoft services. Through analysis of 480 incidents and 26 authentic HTML samples, we identified a multi-tier threat actor employing advanced behavioral tracking and operating distributed phone scam networks. ![Figure\_1\_Campaign\_Timeline\_Visualization](https://blog.identityautomation.com/hs-fs/hubfs/Figure_1_Campaign_Timeline_Visualization.png?width=2470&height=1338&name=Figure_1_Campaign_Timeline_Visualization.png) ## Key Findings Campaign Scale: 480 total incidents spanning 578 days Azure infrastructure abuse: Systematic exploitation of \*.web.core.windows\[.\]net domains Recent Activity: August 2025 with coordinated LuckyOrange training deployment ## Multi-Tier Threat Actor Attribution ![Figure\_2\_Threat\_Actor\_Hierarchy](https://blog.identityautomation.com/hs-fs/hubfs/Figure_2_Threat_Actor_Hierarchy.png?width=1848&height=1728&name=Figure_2_Threat_Actor_Hierarchy.png) ## Primary Threat Actor (Advanced Tracking Group) - LuckyOrange Site ID: 45acXXXX (11 incidents) - Google Analytics: G-RRSK58XXXX - Primary phone: +1-844-XXX-2514 (36 instances) - Victim geolocation: ipwho.is API Integration - Backup call center: +1-888-XXX-8848 ## Secondary Operations (866 Prefix Group) - Primary phone: +1-866-XXX-4179 (21 instances) - Secondary phone: +1-866-XXX-4640 (14 instances) - Basic Google Analytics tracking - Volume-based phone scam operations ## Affiliate Network - Six (6+) distributed call centers using 855, 844, 877, 833 prefixes - Shared template infrastructure (tapa.css, fluctuate animations) - Coordinated deployment patterns ## Technical Analysis #### Behavioral Tracking Infrastructure The primary threat actor employs a sophisticated victim tracking: ![Figure\_3\_LuckyOrange\_Site\_ID](https://blog.identityautomation.com/hs-fs/hubfs/Figure_3_LuckyOrange_Site_ID.png?width=1498&height=280&name=Figure_3_LuckyOrange_Site_ID.png) ## Template Sharing Analysis ![Figure\_4\_Side-by-side\_comparison\_CSS](https://blog.identityautomation.com/hs-fs/hubfs/Figure_4_Side-by-side_comparison_CSS.png?width=2464&height=980&name=Figure_4_Side-by-side_comparison_CSS.png) - 14 samples: Use identical CSS template (tapa.css) - 11 samples: Implement fluctuate animation keyframes - 16 samples: Utilize jQuery framework ## Phone Scam Operations ![Figure\_5\_Phone\_Number\_Distribution](https://blog.identityautomation.com/hs-fs/hubfs/Figure_5_Phone_Number_Distribution.png?width=1672&height=1240&name=Figure_5_Phone_Number_Distribution.png) - Primary Tier: +1-844-XXX-2514 (36 instances) - Secondary Tier: +1-866-XXX-4179 (21 instances) - Affiliates: 6+ additional numbers ## Conclusion The investigation revealed a sophisticated threat actor ecosystem operating one of the longest-running phishing campaigns against K12 schools. The multi-tier attribution model creates actionable intelligence for threat hunting and defensive operations. The length of the campaign and advanced tracking infrastructure indicate a well-resourced, persistent threat actor likely generating significant revenue through phone scam monetization. **Want to ensure your school system can stay ahead of increasingly sophisticated phishing attacks? [Learn more](https://www.identityautomation.com/products/phishing-protection) about how your district can benefit from PhishID!** Aug 27, 2025 ### Related Content [All Resources](https://blog.identityautomation.com) [![](https://blog.identityautomation.com/hs-fs/hubfs/hacker-attacks-phishing-mail.jpg?width=352&name=hacker-attacks-phishing-mail.jpg)](https://blog.identityautomation.com/phishing-attack-on-k12-schools) Apr 18, 2025, 8:43:41 AM ##### [Phishing Attack on K-12 Schools: How it Worked and How to Stay Safe](https://blog.identityautomation.com/phishing-attack-on-k12-schools) Picture this: you open an email that looks like it’s from your school’s IT team, urging you to log... [![](https://blog.identityautomation.com/hs-fs/hubfs/Phishing-threat.jpg?width=352&name=Phishing-threat.jpg)](https://blog.identityautomation.com/k12-student-cybersecurity-risks) May 1, 2025, 5:10:04 PM ##### [6 Ways K12 Student Accounts Pose A Growing Cybersecurity Risk—And How to Stop It With PhishID](https://blog.identityautomation.com/k12-student-cybersecurity-risks) In today’s digital-first classrooms, student accounts are essential tools for learning — but... [![phishing protection](https://blog.identityautomation.com/hs-fs/hubfs/protect-your-district-from-phishing-attacks.jpg?width=352&name=protect-your-district-from-phishing-attacks.jpg)](https://blog.identityautomation.com/k12-phishing-protection-program) Aug 6, 2024, 1:17:12 PM ##### [Protect Your District from Phishing Attacks ](https://blog.identityautomation.com/k12-phishing-protection-program) As phishing attacks rise, safeguarding your school district is more important than ever. [![](https://blog.identityautomation.com/hs-fs/hubfs/shutterstock_2441922909.jpg?width=352&name=shutterstock_2441922909.jpg)](https://blog.identityautomation.com/strategies-for-k-12-it-budget-planning) Aug 20, 2025, 7:38:44 AM ##### [Five Strategies for K-12 IT Budget Planning](https://blog.identityautomation.com/strategies-for-k-12-it-budget-planning) Budget season looms. As soon as school starts, you have approximately four minutes before your... [![IA-a-Jamf-Company\_stacked-darkmode@451x164 (1)](https://blog.identityautomation.com/hs-fs/hubfs/IA-a-Jamf-Company_stacked-darkmode@451x164%20(1).png?width=276&height=100&name=IA-a-Jamf-Company_stacked-darkmode@451x164%20(1).png "IA-a-Jamf-Company_stacked-darkmode@451x164 (1)")](https://www.identityautomation.com) - Identity Solutions - [Identity Lifecycle Management](https://www.identityautomation.com/products/identity-lifecycle-management/) - [Access Governance](https://www.identityautomation.com/products/access-governance) - [Authentication](https://www.identityautomation.com/products/authentication) - [Threat Detection & Response](https://www.identityautomation.com/products/threat-detection-and-response) - [FusionID](https://www.identityautomation.com/fusionid) - Classroom Solutions - [Student-Teacher Portal](https://www.identityautomation.com/products/student-teacher-portal) - [Rostering](https://www.identityautomation.com/products/rostering) - [Insights](https://www.identityautomation.com/products/insights) - Industries - [K-12](https://www.identityautomation.com/industries/k-12-education) - [Higher Ed](https://www.identityautomation.com/industries/higher-ed) - [Healthcare](https://www.identityautomation.com/industries/healthcare) - Resources - [Knowledge Base](https://blog.identityautomation.com) - [Events](https://www.identityautomation.com/resources/events) - [Support](https://help.rapididentity.com/) - [Trust Center](https://www.identityautomation.com/trust-center) - [SSO & Rostering Integrations](https://www.identityautomation.com/sso-rostering-integration) - [About Us](https://www.identityautomation.com/about-us) - [Why IA?](https://www.identityautomation.com/why-ia) - [Careers](https://www.jamf.com/about/careers/) - DIR-CPO - [DIR-CPO-4849](https://www.identityautomation.com/dir-cpo-4849) - [DIR-CPO-5694](https://www.identityautomation.com/dir-cpo-5694) [Contact Us](https://www.identityautomation.com/contact) [Request A Demo](https://www.identityautomation.com/request-a-demo) [Privacy Policy](https://www.identityautomation.com/privacy-policy) [Terms & Conditions](https://www.identityautomation.com/terms-of-use) © 2026 | All Rights Reserved