Thousands of school bomb threat emails in Europe were sent from previously hacked accounts

Thousands of schools in Italy and across Europe have been disrupted after receiving bomb threats from someone claiming to be “Mikhail Andropov.” Two email accounts associated with the mass threat campaign had previously appeared in infostealer databases, suggesting that their login credentials had been stolen, security firm Hudson Rock has found.

Faux bomb threats from university email accounts have been sowing chaos across schools in Europe.

Cybersecurity researchers found evidence of prior email account compromise: well before the bomb threats landed, the emails appeared in infostealer records with passwords and other data extracted from infected computers.

This raises questions about why big tech and other institutions fail to detect exposed credentials, prevent account abuse, and block threatening mass emails.

The emails contained extremely violent threats. The sender, claiming to be “Mikhail Andropov, leader of the Vilayat of Misoginistan,” threatened genocide and claimed explosives had been planted in school buildings and the prime minister’s car.

The same email was sent (CC) to hundreds of recipients at a time, with no specific details about the alleged threats.

What do we know about the accounts?

Hudson Rock analyzed two university email accounts that linked to the threats.

One of the addresses, identified by Italian media and other sources, belonged to an Egyptian university: [email protected].

This email address was used by someone on a computer called “MOSAAD-PC” – it was compromised back on October 1, 2021, more than five years ago. The attackers installed Vidar infostealer malware and exfiltrated credentials, including a Microsoft account password. The owner reused passwords across services.

“The accompanying browser-password export contains 112 credential records. Twenty use the university email address, including two saved against Microsoft authentication pages. The export identifies Google Chrome as the source browser,” Hudson Rock said in their Infostealers blog post.

The malware can steal much more: session cookies, system data, cryptocurrency wallets, etc. Other researchers shared even credit card numbers linked to the account.

The findings don’t prove that the credentials remained valid, don't identify the eventual email-sending system, and don't indicate any subsequent account access or abuse.

“Authentication and mail-delivery records from the providers are needed to determine whether these credentials were used to send the threats,” the researchers explain.

Another flagged email address, used to send bomb threats, belongs to a Taiwanese university: [email protected].

Hudson Rock found the address in AlienTXTBASE, a leaked database of aggregated infostealer data. Last year, this data was added to services such as “Have I Been Pwned.”

The record matches a university address with a Microsoft authentication URL, and includes an exposed password.

Non permetteremo a una mail anonima di decidere il calendario scolastico dei nostri figli. Chi ha fatto questo voleva una Nazione ferma e impaurita. Troverà una Nazione che domani si sveglia, accompagna i figli a scuola e va a lavorare. È questa la risposta, ed è la più forte che abbiamo.

undefined Giorgia Meloni (@GiorgiaMeloni) November 11, 2026

What could have been done?

Both accounts were exposed long before the threats were sent to thousands of schools. While the exact delivery path, sign-in events, and potential password reuse remain to be determined, the researchers say the campaign could potentially have been stopped at several stages.

Both the email provider and the universities had tools available to detect stolen credentials, secure accounts, and prevent abuse.

“For identities using Microsoft authentication, Microsoft and the institutions administering those accounts have opportunities to interrupt the chain,” the report reads.

A credential leak should trigger an account security response, including revoking active sessions, prompting password changes, removing suspicious login methods, and mailbox rules.

A credential change is not enough if the device itself remains infected and attackers retain access. Microsoft provides tools and guidance for investigating and remediating affected devices, as well as responding to compromised cloud accounts.

Finally, bulk threats and other suspicious emails shouldn’t reach recipients.

“New access patterns and sudden bulk sending deserve prompt investigation. Where mail is hosted in Microsoft’s cloud, its outbound protections include sending restrictions and alerts for suspicious sending patterns,” the report suggests.

On November 11, before 10 a.m., more than 6,300 schools in Italy received bomb threats and hundreds of schools were evacuated, according to ANSA. No explosive devices have been found so far.

Similar threats were reported at more than 470 schools in Scotland, 300 in Northern Ireland, and elsewhere. Police Service of Northern Ireland assesses the emails as hoaxes.