Fake sexual misconduct and Title IX emails are pushing Zoho Assist onto university staff: breaking down the Google Drive lure and how to spot abused legitimate remote access tools before they install

On September 10, Cofense published a breakdown of a phishing campaign targeting higher ed institutions. The emails impersonate a university president. They allege a sexual misconduct concern involving a student or staff member. They ask the recipient to install a remote access tool to review the case. The case is fabricated. The tool is a technically legitimate remote access product, Zoho Assist, and in this campaign it is the payload. ¹

The email, step by step

The messages spoof a real university’s letterhead, signature block, and email domain. In the attempts Cofense documented, the impersonated leaders were the president or dean of Notre Dame, the University of Virginia, and the Medical College of Wisconsin. The emails come from a shared template. The sender name and signature change per target, and the rest of the body stays close to identical.

There is no attachment. The body links to a Google Drive file, and that file holds a second link. The second link downloads the Zoho Assist installer. The email names the file, AZ_Access_My_Department, tells the recipient to download and install it, and walks through the installation steps.

The hop that gets past the mail gateway

The first hop is a Google Drive URL, and that is the hop the mail gateway has to let through. Cofense notes the current iteration of the campaign already bypasses Integrated Cloud Email Security controls without any generated variation between emails. Drive has carried this kind of payload before. Cofense ties the same two-step pattern to the Poco RAT campaign against Spanish-language targets and to information stealer campaigns aimed at the hospitality industry.

The final download sits on abused non-Google cloud services and on threat actor domains. Those domains are typically less than a month old, which is one of the few cheap tells a filter or an analyst can act on early.

The target list is the tell

The bulk of the documented attempts hit healthcare-affiliated universities, medical colleges and teaching hospitals. Cofense puts the share of healthcare-related targets above 80%, and it treats that concentration as intentional. Public health is a CISA-designated critical infrastructure sector, and a compromise on a teaching hospital machine carries regulatory exposure on top of the intrusion. The lure is tuned to the roles a Title IX notification would land on: administration, student affairs, HR, legal, and anyone who handles external university partnerships.

The legitimacy gap

Once it lands on the machine, Zoho Assist gives the attacker screen view and control, file transfer off the machine, and the ability to drop additional files, including ransomware. The tool’s legitimacy is what makes it hard to stop. Endpoint controls that allowlist remote access software by product name cannot tell a support session from this campaign.

This is not the first intrusion to use it. In June, Microsoft’s DART team reported a ransomware investigation where one actor had established remote access through Zoho Assist, Cloudflare tunneling, and SSH sessions configured in VS Code, while a second unrelated actor operated in the same environment. ²

Detection has to move from product name to context. The signals worth monitoring: a remote access tool appearing on an endpoint where it has never run before, an install that traces to a one-month-old domain, and an outgoing remote session to a host that is not in the support inventory. The campaign maps to spearphishing link (T1566.002), user execution through a malicious link (T1204.001), and impersonation (T1656), which is a useful summary for the ticket. ³

Breaking the chain before the install

The red flags sit in the message itself. An allegation of sexual misconduct arrives from the leadership of another institution. The link goes to consumer cloud storage, and that storage points to a second download. The message asks the recipient to install a program in order to view a document. Legitimate documents do not require programs. Cofense’s mitigation list points to out-of-band verification through legal or compliance before anyone acts on a cross-institutional notification, and that is the move that breaks the campaign, because a fabricated case cannot survive a phone call to a known number.

My seat is the research side, the mail gateway, and the endpoint side. I pull the campaign details, the red flags, and the detection guidance, I run the mail-side link handling on the gateway I own, and I hunt the endpoints in Defender for first-time remote access tool installs. What I would relay to legal and compliance is the out-of-band verification, and that is the step that closes the loop with the people who act on a cross-institutional notification. The user-side control is a habit: when a high-stakes allegation arrives with an install request, verify it through a channel you already trust.

The campaign will outlive any single IOC, and the template will keep changing. The habit of verifying through a trusted channel survives both.