Phishing attack compromises Morehouse student accounts

By: Freddrell Green

Morehouse College has long strived to maintain security for its student body. It has withstood generations of strife — from the reconstruction period to the aftermath of the civil rights movement. But in an era where technology provides a new means for attack, can Morehouse adapt?

Surge in phishing emails

From June 26 to July 22, students were targeted with various phishing messages from hacked student emails. The emails included falsified subject lines such as email verification links, school-approved jobs, work study positions and claims of eligibility for direct funding from Morehouse.

Morehouse’s Information Technology Services released a statement following the first phishing email released on June 26, stating that a student’s Morehouse account was compromised after clicking on a malicious link. Since then, Barracuda Email Protection, the college’s email security software, has automatically erased phishing emails as part of its filtering process.

Of the students potentially affected, seven were confirmed by Barracuda to have had their accounts compromised.

Students sabotaged by false IT assistant

The Maroon Tiger interviewed three of the seven students who were hacked. They all reported being contacted via phone by someone falsely claiming to represent the Morehouse IT department.

“When it’s something school related, I know a lot of the students don’t want to put any of their things in jeopardy,” junior Dalen Frazier said. “So when Morehouse is in the name and email, it’s kind of hard to ignore it.”

Frazier, along with junior Jeremiah Goodman and sophomore Mekhi Holly, clicked on links that claimed to be email verification requests. Frazier still has no access to his Morehouse email following the incident.

In Holly’s case, the hacker was able to reach him first through his high school email, and eventually gain access to his Morehouse email, a unique instance compared to the previous two students.

False IT assistant revealed

Through further reporting, The Maroon Tiger identified a source in junior Imari Welcher, who identified the serial hacker. Welcher had an encounter with the hacker during an email exchange over a potential “job opportunity”. The exchange would then transition from email to text messages. 

The phone number used by the hacker, who identified himself to Welcher as Bryan Allison, matched the number used to target both Frazier and Holly.

The situation escalated when Allison asked for Welcher to deposit money into an “orphanage supervisor fund.” Welcher would deny offering any services to Allison and eventually find out after a phone call with him that he was of foreign descent based on the sound of his voice.

Welcher was then messaged by another phone number that threatened him to send money to his account. He continued these threats by sending images of bodies with laceration marks, a photo of a set of firearms and a video of a man wearing a black ski mask and suit threatening Welcher.

“Listen, you better pay my money or I will cut all of your family’s heads and your f—- head too. You’re gonna be the first one if you don’t pay the f—- funds. We ain’t playing no games. We from the (indistinguishable) mafia. If you don’t pay the money, we ready to pull up to your crib and shoot everybody and cut off all your family’s heads. We ain’t playing no games. Pay the fund and you will be good,” the masked figure stated in the video.

Welcher ended the exchange by warning Allison that he would pursue legal action. Allison did not respond further.

Can Morehouse adapt?

In light of the incident, students expressed concern about Morehouse’s digital infrastructure. Welcher pointed to a lack of cybersecurity education as one area of weakness.

“I know for a fact that Spelman has a class about online safety…Howard has a class for online safety,” Welcher said. “I do believe that Morehouse has its blind spots, and in my opinion, as of now, technology is a pretty large blind spot at Morehouse College.”

The college’s brand was also affected, with Allison getting away with hacking multiple students under the guise of an assistant for the IT department. Frazier said the school must improve how official communications are identified. 

“If they’re going to send out emails, there has to be something on it to let us know that this is really Morehouse,” Frazier said.

Despite the challenges, the students agreed that one precaution going forward is to trust your instincts.

“If it feels off, it’s probably off,” Holly said. 

The Maroon Tiger requested an interview with Vice President Dr. Kimberley Jones to get a statement on the surge in phishing emails but did not receive a response from her. Communications and Engagement Specialist Chimere Stanford responded asking for more information on the matter and stated that IT services would investigate it further.

Copy edited by: Geondre Baldwin, Editor-in-Chief, Niles Garrison, Managing Editor of Print and Joshua Bass, News and Politics Editor