Unicoi County Schools has issued a security alert after attackers compromised a staff account and used it to distribute phishing emails to employees, students and members of the wider community.
Unicoi County Schools in Tennessee has warned staff, students, parents and community members about an ongoing phishing campaign after a staff account was compromised and used to distribute malicious emails.
The school district said the incident originated outside its network when a staff member received a fraudulent login prompt designed to steal account credentials.
After gaining access to the account, the attacker used it to send a mass phishing email to district staff, student accounts and external community addresses.
The message, titled ‘joyful gathering on September 6th!’, encouraged recipients to follow a link and download a file named ScreenConnect, which was presented as part of an RSVP process for an upcoming event.
Unicoi County Schools said its investigation indicated the campaign was targeting the wider region rather than solely the school district. It warned that similar unexpected messages received from local individuals, businesses or organisations could have originated from other compromised accounts.
Following discovery of the attack, the district disabled the affected staff account and terminated its active authentication sessions.
Security controls on district-managed devices also successfully prevented the ScreenConnect file from running on school equipment.
The district stressed that its core student databases, grade portals and sensitive records remained secure and had not been compromised.
Students, parents and other community members who received the email have been advised to delete it without downloading or running the file.
Anyone who attempted to run the ScreenConnect file on a personal computer has been advised to perform a full antivirus scan.
Unicoi County Schools has also encouraged users to enable multi-factor authentication on personal email, banking and social media accounts, carefully verify unexpected login prompts and change passwords if credentials were entered into a suspicious website.
