The Threats Were a Hoax. The Hacked Accounts Were Real.

Before 10 a.m. on November 11, more than 6,300 schools across Italy received the same email: a bomb threat, sent in bulk, claiming explosives had been planted in school buildings and in the prime minister’s car. Hundreds of schools evacuated. Police searched building after building and found nothing. The threats were a hoax — but the email accounts that sent them were very real, and the passwords behind them had been stolen five years ago.

The sender claimed to be “Mikhail Andropov, leader of the Vilayat of Misoginistan,” and threatened genocide alongside the bomb claims. The same message was copied to hundreds of recipients at a time, with no specific details about any alleged device. It was not confined to Italy, either: more than 470 schools in Scotland and 300 in Northern Ireland received similar threats, and the Police Service of Northern Ireland assessed the emails as hoaxes. Italy’s prime minister said publicly that no anonymous email would decide the school calendar — and that the answer was to send children to school anyway.

So how did a hoax reach thousands of schools at once? Security firm Hudson Rock traced two sender addresses back to old infostealer records — credentials harvested from infected computers and traded or leaked online. One address belonged to an Egyptian university. Hudson Rock says it was compromised on October 1, 2021, on a computer the researchers call “MOSAAD-PC,” when Vidar infostealer malware exfiltrated credentials including a Microsoft account password. The accompanying browser-password export contained 112 credential records, twenty of them using the university email address, including two saved against Microsoft authentication pages. The owner had reused passwords across services. A second flagged address, belonging to a Taiwanese university, turned up in AlienTXTBASE, an aggregated leaked database of infostealer data, again with an exposed password and a Microsoft authentication URL attached.

That should worry every organization with an email domain: the credentials were not stolen last week. They were stolen in 2021, sat in infostealer logs for years, and — if they were used at all — only surfaced when someone decided to turn them into a weapon. A password stolen half a decade ago can still empty a school, as long as nobody has changed it, revoked the sessions attached to it, or noticed it sitting in a leaked database.

But the honest version of this story includes a caveat Hudson Rock itself stresses. The findings do not prove the credentials were still valid when the threats were sent, do not identify the system that actually sent the emails, and do not show any subsequent access to or abuse of the accounts. Authentication and mail-delivery records from the providers are needed to determine whether these credentials were used to send the threats at all. The link between the old theft and the new hoax is strong circumstantial evidence, not a proven chain — and that distinction matters, because the same firm has been on the other side of an unproven claim before: its researchers recently showed that a much-hyped Gmail “zero-day” claim rested on no demonstrated proof at all.

What is not in doubt is the failure the campaign exposes. Both accounts were exposed long before the threats were sent, and the researchers say the campaign could have been stopped at several stages. Email providers and the universities administering these accounts had tools available to detect stolen credentials, secure the accounts, and prevent abuse. For identities using Microsoft authentication, Microsoft and the institutions involved had opportunities to interrupt the chain: a credential leak should trigger an account security response, including revoking active sessions, prompting password changes, and removing suspicious login methods and mailbox rules. And bulk threats should never have reached recipients: sudden bulk sending deserves prompt investigation, and Microsoft’s cloud mail includes sending restrictions and alerts for suspicious patterns.

If you run email for an organization, this is a cheap lesson to apply. First, check whether your domain’s credentials appear in infostealer logs — Have I Been Pwned and commercial monitoring exist for this — and force resets where they do. Second, when a credential is exposed, revoke the sessions attached to it; changing a password while a stolen session token stays live changes nothing. Third, enforce multi-factor authentication and audit the account for login methods and mailbox rules you did not create. Fourth, make sure your mail provider’s outbound abuse alerts are on and someone actually reads them: a single account suddenly copying hundreds of recipients is the kind of anomaly that should trigger a human within minutes, not a news cycle. Mass-messaging infrastructure turned against its users is not a new trick — the same month, a leak of 125 million text messages put live bank codes in strangers’ hands — but it only works when the stolen credential is still alive.

No bomb was ever found. No child was hurt. But 6,300 schools lost a morning, hundreds evacuated, and three countries spent a day chasing a ghost — because passwords stolen in 2021 were still good enough to use in 2026. The hoax was fake. The hacked accounts were real. The gap between those two facts is where the next one will come from.