Top University Websites Hijacked to Serve Porn and Malware in Widespread Scam
The Hijack
Hundreds of subdomains belonging to prestigious universities including UC Berkeley, Columbia University, and Washington University in St. Louis are redirecting visitors to explicit pornographic content and malicious scam pages, researcher Alex Shakhov revealed.
The compromised domains include causal.stat.berkeley.edu showing porn videos, conversion-dev.svc.cul.columbia.edu pointing to a porn site called "Brazzers Gym," and provost.washu.edu hosting a fake malware alert demanding payment. In total, at least 34 universities have been affected.
“This is not a sophisticated hack—it’s basic neglect,” said Shakhov, founder of SH Consulting. “The scammers are exploiting a clerical error that universities never bothered to fix.”
Background: The Technical Flaw
When universities create subdomains (e.g., provost.washu.edu), they set up a CNAME record that links the subdomain to a canonical domain. This is common for temporary projects, event sites, or third‑party services.
Once the subdomain is no longer needed, administrators often forget to delete the CNAME record. The orphaned record becomes a dangling pointer—a prime target for attackers like the group tracked as Hazy Hawk, who register the now‑unowned canonical domain and take control of the subdomain.
Shakhov explained: “It’s like leaving your front door unlocked after moving out—anyone can walk in and put up their own sign.”
What This Means
The hijacked subdomains damage the universities’ reputations, erode trust in their .edu domains, and expose users to explicit content and scams. Victims landing on the fake malware page are pressured to pay a fee for a non‑existent cleanup.
Google search results currently list thousands of these hijacked pages, meaning the problem is far from contained. “Universities must audit their DNS records immediately and remove obsolete CNAME entries,” Shakhov urged.
Without prompt action, the same technique could be used to serve phishing sites, distribute malware, or conduct other attacks under a trusted .edu banner.
Related Articles
- Ann Leckie's New Sci-Fi Novel 'Radiant Star' Earns Immediate Praise for Underground World-Building
- Rocket Industry Update: Starship, Blue Moon, and the Pentagon's Space Defense Initiative
- Exploring the Moon: A Q&A with 'Pragmata' Director Yonghee Cho on Crafting Capcom's Sci-Fi Epic
- Space News Q&A: Starship Updates, Blue Moon Mission, and the Golden Dome Defense Initiative
- 5 Key Moments from the Artemis 2 Astronauts' White House Visit with President Trump
- How to Find Your Favorite Artemis II Moon Mission Photos from NASA's New Release
- VECT Ransomware's Fatal Flaw: How a Critical Encryption Error Turns It Into a Data Wiper
- The Quantum Gambit: How a New Ransomware Family Exploits NIST Standards