Phishing is evolving — and schools are quickly becoming one of the most targeted sectors. In 2025, one of the most common attack trends we’re seeing is AI-generated impersonation emails, especially those mimicking principals, superintendents, and even parent accounts. These attacks are highly convincing, using real names, job titles, and even writing styles scraped from public websites or social media. The goal? Trick staff into approving fraudulent invoices, clicking malicious links, or sharing sensitive data — often during busy times like school openings or testing season.

What to Watch For:

• Urgent tone with odd timing — late night, weekend, or holiday messages.
• Misspelled domains that look nearly identical to school email addresses.
• Requests for wire transfers, gift cards, or login credentials.

DOF’s Quick Defense Tips:

1. Train staff to verify requests through a second channel (like a phone call).
2. Flag suspicious domain look-alikes using advanced email security tools.
3. Update SPF, DKIM, and DMARC records to prevent spoofing.

“Phishing isn’t just about bad grammar anymore, ” says DOF’s cybersecurity team. “It’s about trust — and attackers are getting smarter at faking it.”

DOF offers cybersecurity training, policy templates, and AI-based tools like Abnormal Security to stop phishing threats before they ever hit the inbox.