Top University Websites Hijacked to Serve Porn and Malware in Widespread Scam
The Hijack
Hundreds of subdomains belonging to prestigious universities including UC Berkeley, Columbia University, and Washington University in St. Louis are redirecting visitors to explicit pornographic content and malicious scam pages, researcher Alex Shakhov revealed.
The compromised domains include causal.stat.berkeley.edu showing porn videos, conversion-dev.svc.cul.columbia.edu pointing to a porn site called "Brazzers Gym," and provost.washu.edu hosting a fake malware alert demanding payment. In total, at least 34 universities have been affected.
“This is not a sophisticated hack—it’s basic neglect,” said Shakhov, founder of SH Consulting. “The scammers are exploiting a clerical error that universities never bothered to fix.”
Background: The Technical Flaw
When universities create subdomains (e.g., provost.washu.edu), they set up a CNAME record that links the subdomain to a canonical domain. This is common for temporary projects, event sites, or third‑party services.
Once the subdomain is no longer needed, administrators often forget to delete the CNAME record. The orphaned record becomes a dangling pointer—a prime target for attackers like the group tracked as Hazy Hawk, who register the now‑unowned canonical domain and take control of the subdomain.
Shakhov explained: “It’s like leaving your front door unlocked after moving out—anyone can walk in and put up their own sign.”
What This Means
The hijacked subdomains damage the universities’ reputations, erode trust in their .edu domains, and expose users to explicit content and scams. Victims landing on the fake malware page are pressured to pay a fee for a non‑existent cleanup.
Google search results currently list thousands of these hijacked pages, meaning the problem is far from contained. “Universities must audit their DNS records immediately and remove obsolete CNAME entries,” Shakhov urged.
Without prompt action, the same technique could be used to serve phishing sites, distribute malware, or conduct other attacks under a trusted .edu banner.
Related Articles
- How Plants Evolved into 'Hopeful Monsters' During Earth's Worst Crises
- New Benchmark Automatically Attributes Failures in LLM Multi-Agent Systems
- Fields in Particle Physics: From Classical Origins to Quantum Reality
- Lightweight Linux Distros for Old Laptops: A 4GB RAM Test Reveals a Surprising Winner
- The Art of Storytelling in User Research: A Three-Act Guide
- VS Code Python Environments Extension: April 2026 Update Boosts Speed and Reliability
- Meta's Autodata: Autonomous AI Agents That Revolutionize Training Data Creation
- How Nanobot Swarms Are Transforming Medicine and the Environment: A Step-by-Step Guide