Hackers Weaponize Printing Software Flaws to Steal Passwords from Schools and Universities

A New Wave of Credential Theft Targets Education

Cybersecurity researchers have uncovered a sophisticated attack strategy where malicious actors are exploiting security holes in widely-used document management software to steal login credentials from schools and universities across North America and Europe. The campaign involves sending millions of deceptive emails that use a technical trick to slip past email security systems designed to catch fraudulent messages.

According to analysis by the Arctic Wolf Adversary Research Team, the attackers have identified and weaponized two previously unknown vulnerabilities in PaperCut software—a popular printing and document system used by educational institutions to manage how students and staff access printers and shared resources. By bypassing the authentication layer that normally protects these systems, the attackers can gain unauthorized access to institutional networks.

Understanding the Attack Method

Think of your email filter like a security guard checking ID cards at a building entrance. The attackers have found a way to hide a fake ID inside an invisible pocket—the "invisible Unicode" technique mentioned in the alert. Unicode characters are special codes computers use to display text in different languages and formats. By inserting these invisible characters into phishing emails, the messages look legitimate to both email filters and human eyes, but they're actually designed to deceive recipients into revealing their passwords.

The two specific vulnerabilities identified—labeled CVE-2026-81578 and CVE-2026-82078—essentially create unlocked back doors into PaperCut systems. Rather than requiring valid credentials to enter, attackers can slip through these flaws and gain access as if they had legitimate permissions.

Why This Matters for Educational Institutions

Schools and universities store enormous amounts of sensitive information: student records, financial data, research findings, and personal details about minors. A breach at these institutions doesn't just affect IT departments—it impacts thousands of families and can compromise decades of academic work.

• Student data at risk: Names, addresses, social security numbers, and academic records could be exposed
• Research theft: Universities conduct valuable research that attackers could steal or hold for ransom
• Operational disruption: Compromised systems could shut down access to critical educational resources
• Trust erosion: Parents and students lose confidence in institutional security

What You Should Do Now

If you work in or attend an educational institution, take these steps immediately:

• Check if your school uses PaperCut software by contacting your IT department
• Ask whether your institution has applied security patches for these vulnerabilities
• Be extra cautious with emails asking you to verify passwords or login information—legitimate institutions never request this via email
• Report suspicious emails to your security team rather than clicking links
• Use strong, unique passwords for institutional accounts
• Enable multi-factor authentication wherever your school offers it

IT administrators at affected organizations should prioritize applying available security patches and monitor systems for signs of unauthorized access attempts.

As educational institutions remain attractive targets for attackers seeking valuable data, staying informed and vigilant remains your strongest defense.