School Bomb Threat Emails: Sender Accounts Linked to Infostealer Data (Vidar, AlienTXTBASE)

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5844 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5844 Entra ID Cloud Account Sign-In From First-Seen Country (Stolen Credential Replay)

Flags a user whose successful Entra ID sign-in comes from a country not seen in the preceding days of history. Credentials exposed in Vidar and AlienTXTBASE stealer logs (T1078.004) are replayed from attacker infrastructure, so the sign-in geography usually differs from the account owner's baseline. The search also counts invalid-password failures (error 50126) per user so replay that follows guessing or stuffing of reused passwords (T1110.004) is visible; the research observed password reuse in the Vidar-associated log. Exposure in a stealer log is not proof of misuse, so each hit needs verification against the user's travel and VPN usage.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1078.004, T1110.004
• Data sources: azure:aad:signin (Entra ID sign-in logs via Splunk Add-on for Microsoft Cloud Services), SigninLogs (Microsoft Sentinel), azure signinlogs
• Severity: medium
• Confidence: medium

Splunk SPL

index=azure sourcetype="azure:aad:signin" earliest=-7d@d
| eval err=tonumber('status.errorCode'), country='location.countryOrRegion', ok=if(err=0,1,0), bad_pw=if(err=50126,1,0)
| where isnotnull(userPrincipalName) AND isnotnull(country)
| stats min(eval(if(ok=1,_time,null()))) as first_seen max(eval(if(ok=1,_time,null()))) as last_seen sum(ok) as successful_signins sum(bad_pw) as bad_password_attempts values(ipAddress) as src_ips values(clientAppUsed) as client_apps values(authenticationRequirement) as auth_requirement values(appDisplayName) as apps by userPrincipalName country
| eventstats sum(bad_password_attempts) as user_bad_pw by userPrincipalName
| where successful_signins>0
| eventstats dc(country) as countries_7d min(first_seen) as user_first_seen by userPrincipalName
```baseline is the earlier days in the window; alert on a country first seen in the last 24h for a user with older history```
| where first_seen>=relative_time(now(),"-24h") AND user_first_seen<relative_time(now(),"-24h") AND countries_7d>=2
| convert ctime(first_seen) ctime(last_seen)
| sort - user_bad_pw - successful_signins

Microsoft KQL

let lookback = 7d;
let recent = 24h;
let signins = SigninLogs
    | where TimeGenerated > ago(lookback) and ResultType in (0, 50126)
    | extend Country = tostring(LocationDetails.countryOrRegion)
    | where isnotempty(Country)
    | summarize FirstSeen=minif(TimeGenerated, ResultType == 0), LastSeen=maxif(TimeGenerated, ResultType == 0), SuccessfulSignIns=countif(ResultType == 0), BadPasswordAttempts=countif(ResultType == 50126), SourceIPs=make_set(IPAddress, 10), Apps=make_set(AppDisplayName, 10), ClientApps=make_set(ClientAppUsed, 5), AuthRequirement=make_set(AuthenticationRequirement, 3) by UserPrincipalName, Country;
let baseline = signins | where FirstSeen <= ago(recent) | distinct UserPrincipalName;
signins
| where SuccessfulSignIns > 0 and FirstSeen > ago(recent)
| join kind=inner baseline on UserPrincipalName
| project UserPrincipalName, Country, FirstSeen, LastSeen, SuccessfulSignIns, BadPasswordAttempts, SourceIPs, Apps, ClientApps, AuthRequirement
| order by BadPasswordAttempts desc, SuccessfulSignIns desc

Sigma

title: Entra ID Successful Single-Factor Sign-In Over Legacy Authentication Protocol
id: 7c1d9b52-3e41-4a8f-9a6e-5d2b8f10a3c1
status: experimental
description: Detects successful Entra ID sign-ins that used only a password over a legacy client protocol, a pattern consistent with replay or stuffing of credentials exposed by infostealers (Vidar, AlienTXTBASE) against cloud email accounts. Sigma cannot express the per-user geography baseline used in the SPL and KQL versions, so this variant is scoped to legacy protocols that bypass MFA. Exposure in a stealer log is not proof of misuse.
references:
  - https://www.infostealers.com/article/school-bomb-threats-hudson-rock-finds-reported-sender-accounts-in-infostealer-data/
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks
author: Threadlinqs Team
date: 2026-11-12
tags:
  - attack.initial-access
  - attack.defense-evasion
  - attack.t1078.004
  - attack.credential-access
  - attack.t1110.004
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResultType: 0
    AuthenticationRequirement: singleFactorAuthentication
    ClientAppUsed:
      - 'IMAP4'
      - 'POP3'
      - 'Authenticated SMTP'
      - 'SMTP'
      - 'Exchange ActiveSync'
      - 'Other clients'
  condition: selection
fields:
  - UserPrincipalName
  - IPAddress
  - ClientAppUsed
  - Location
falsepositives:
  - Multifunction printers and scanners that send mail with basic authentication
  - Legacy line-of-business applications that have not been migrated to modern authentication
level: medium

Known false positives:

• Legitimate travel, conference attendance or a new VPN egress point for a university user
• Students and alumni who sign in from several countries because of remote study or mobile roaming

Tuning notes: Adjust earliest and the 24h recent window to the sign-in retention you hold. Exclude known corporate VPN and proxy egress countries with a lookup. Raise priority when the user also appears in a leaked-credential list or Entra ID Protection risk detection, or when bad_password_attempts is above zero before the first success. Add a requirement of authenticationRequirement=singleFactorAuthentication to cut volume. The Sigma variant needs your SIEM's Entra field mapping.

• 🔒 TL-2026-5844 Successful Sign-In After Entra ID Leaked Credentials Risk Detection · unlock with TL Creds
• 🔒 TL-2026-5844 Hoax Bomb-Threat Email Content From a Single Sender Across Many Recipients · unlock with TL Creds
• 🔒 TL-2026-5844 Community-Observed Vidar and AiTM Infrastructure Contact (OSINT Sibling Indicators) · unlock with TL Creds
• 🔒 TL-2026-5844 Security Info or Authentication Method Registered on an Entra ID Account · unlock with TL Creds
• 🔒 TL-2026-5844 Exchange Online Inbox Rule That Forwards, Redirects or Deletes Mail · unlock with TL Creds
• 🔒 TL-2026-5844 Archiving of Browser Credential Stores With Compression Utilities (Stealer Staging) · unlock with TL Creds
• 🔒 TL-2026-5844 Bulk External Outbound Email From a Single Mailbox (Compromised Account Abuse) · unlock with TL Creds
• 🔒 TL-2026-5844 Non-Browser Process Touching Chromium Login Data Credential Store (Vidar-Style Theft) · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5844.

Sample indicators (1 of 12)

• Domain: login[.]microsoftonline[.]com

Defanged, TLP:CLEAR. Full set of 12 indicators: unlock with TL Creds.

Technical analysis

Hudson Rock does not establish that the credentials were used to send the threats, that any password was still valid, or who is responsible.

Hoax emails threatening pupils and staff, and referring to an alleged bomb targeting the Italian prime minister, were sent to schools in Italy and the UK/Ireland. The messages used the claimed sender name 'Mikhail Andropov', which is unverified. ANSA, citing the Italian Education Ministry, reported about 6,000 Italian schools received the email; some evacuated and others continued teaching after consulting police. PM Giorgia Meloni said searches found no bombs. The PSNI reported more than 300 Northern Ireland schools received the same message and treated it as a hoax. Police Scotland assessed related messages as hoaxes, and The Journal (Ireland) reported threats to schools and newsrooms using different sender addresses for each. Reporting on an earlier Oct 19, 2026 wave of threatening emails to Northern Ireland, Scotland, Hungary and Serbia schools exists, but no source reviewed links the two waves.

Hudson Rock (infostealers.com, published 2026-11-12) checked the sender addresses reported in the media against its Cavalier infostealer dataset. An Egyptian university address, shown partially in la Repubblica and identified in a public X post, matched a Cavalier machine log classified as Vidar. The log's system information file is dated 2021-10-01 and describes a Windows 7 Ultimate x64 host with a Google Chrome password export of 112 credential records, 20 of which use the university address and 2 of which point to Microsoft authentication URLs (login.microsoftonline.com/common/oauth2/authorize and ccs.login.microsoftonline.com/ccs/common/oauth2/authorize). Password reuse was observed. The Taiwanese address, published by the Italian school IIS G. A. Remondini and attributed by Focus Taiwan to Da-Yeh University (Dayeh University), matched a URL-login-password entry in the AlienTXTBASE stealer-log collection tied to a Microsoft authentication URL. Hudson Rock dates that record to more than a year before the threats (its own assessment). AlienTXTBASE was documented by Troy Hunt (Feb 2025) as roughly 23 billion rows from 744 files (about 1.5TB) distributed through Telegram in URL:email:password format and ingested into Have I Been Pwned.

Focus Taiwan reports that Da-Yeh University's initial investigation found an alumnus account had sent a large volume of email and appeared compromised; the university suspended the account, and the cause and actual sender remain under investigation. Important caveats from the source: no attribution to any person, group or state; matching a sender address does not identify who operated the account; the passwords were not tested and Hudson Rock has not shown they remained valid; the Egyptian log is from 2021; and no token theft or MFA bypass was demonstrated. Record counts are export entries, not unique people. No network IOCs (IPs, domains, hashes) are published, and no CVE applies. Defender value lies in credential exposure response: reset passwords, revoke sessions and tokens, review app passwords, consents and mailbox rules, remediate infected endpoints, move to phishing-resistant authentication, and monitor sign-ins and outbound mail for bulk sending. Only one primary analysis (Hudson Rock) links the accounts to infostealer data, so severity and confidence are conservative.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Initial Access

T1078.004 Cloud Accounts

Defense Evasion

T1078.004 Cloud Accounts

Credential Access

T1555.003 Credentials from Web Browsers

Resource Development

T1586.002 Email Accounts

Remediation

Immediate actions

• Reset passwords for any account verified in infostealer data and revoke all active sessions and refresh tokens
• Review app passwords, registered authentication methods, OAuth consents and mailbox rules on affected accounts
• Suspend or contain accounts showing sudden bulk outbound mail
• Remediate the endpoint that produced the stealer log before restoring access

Workarounds

• Treat matching an address in a stealer log as exposure, not proof of misuse; verify account activity in sign-in and message-trace logs before concluding compromise

Longer-term hardening

• Deploy phishing-resistant MFA such as FIDO2 or passkeys, including for alumni and legacy accounts
• Enable leaked-credential detection and risk-based policies in Entra ID Protection (licensing required)
• Enforce outbound spam limits and alerting on bulk sending
• Monitor stealer-log exposure feeds for organizational email domains and expire dormant alumni accounts

Affected and fixed versions

• Microsoft — Microsoft Entra ID / Microsoft 365 university email accounts
  Vulnerable versions: Accounts whose credentials appear in infostealer logs and have not been rotated

Timeline

• 2021-10-01 System information file in the Vidar-classified Cavalier log for the Egyptian university address is dated 2021-10-01 (Windows 7 Ultimate x64, Chrome password export).
• 2025-02-25 Troy Hunt documents ALIEN TXTBASE (23 billion rows, 744 files) and ingests it into Have I Been Pwned; Infostealers.com publishes its analysis Feb 26.
• 2026-10-19 Separate wave of threatening emails reported to Northern Ireland, Scotland, Hungary and Serbia schools; no source reviewed links it to the Nov 11 wave.
• 2026-11-11 PM Meloni states searches found no bombs; PSNI and Police Scotland treat the messages as hoaxes; IIS Remondini publishes the Taiwanese sender address.
• 2026-11-11 Hoax bomb-threat emails signed 'Mikhail Andropov' reach about 6,000 Italian schools (ANSA) and 300+ Northern Ireland schools (PSNI); Police Scotland and The Journal report related threats.
• 2026-11-12 Hudson Rock publishes findings matching the reported sender addresses to Vidar-associated and AlienTXTBASE infostealer data, without attributing the threats or testing credentials.
• 2026-11-12 Da-Yeh University tells Focus Taiwan its initial investigation found an alumnus account sent a large volume of email and appeared compromised; the account is suspended and the cause remains under investigation.

Sources cited

• PSNI: Threatening emails to over 300 schools being treated as hoax psni.police.uk · Advisory · 2026-11-11
• Police Scotland: Statement after threatening messages sent to schools scotland.police.uk · Advisory · 2026-11-11
• Troy Hunt: Processing 23 Billion Rows of ALIEN TXTBASE Stealer Logs troyhunt.com · Research · 2025-02-25
• Infostealers.com: ALIEN TXTBASE data leak deep analysis infostealers.com · Research · 2025-02-26
• Microsoft Learn: Entra ID Protection risks (leaked credentials) Microsoft · Vendor report · 2026-11-12
• Microsoft Learn: Responding to a compromised email account Microsoft · Vendor report · 2026-11-12
• Microsoft Learn: Revoke user access in Microsoft Entra ID Microsoft · Vendor report · 2026-11-12
• School Bomb Threats: Hudson Rock Finds Reported Sender Accounts in Infostealer Data infostealers.com · Blog · 2026-11-12
• Focus Taiwan: Dayeh University account suspended after emails to Italian schools focustaiwan.tw · News · 2026-11-12
• ANSA: Alarm over bomb threats in 6,000 Italian schools ansa.it · News · 2026-11-11
• ANSA: Meloni - we will not allow an anonymous email to decide the school calendar ansa.it · News · 2026-11-11
• The Journal: Bomb threats to schools and media thejournal.ie · News · 2026-11-11
• la Repubblica: Mail scuole, Mikhail Andropov chi e repubblica.it · News · 2026-11-11
• IIS G. A. Remondini: incident account of the email remondini.net · News · 2026-11-11

More in threat intel

• Abuse of legitimate RMM and remote access tools (MeshAgent, ScreenConnect, Ammyy Admin, RDP): Acronis TRU analysis of RMM tool risk for SMBs, incl. CVE-2024-1709
• Lazarus: Weight-Space Backdoor Technique Hidden in Dormant AI Model Neurons (Microsoft Research)
• QuoIntelligence Weekly Snapshot W39 2026: ClickFix/Exvicy, Graphalgo Go RAT, RemControl Android trojan, Windows Defender zero-day exploit (Nightmare Eclipse)
• CRAFTY FALCON: AI-Assisted Financial Threat Actor Targeting Indian BFSI (CERT-In CIAD-2026-0058)
• ~45 Open-Source AI Hacking Frameworks Mapped; Hundreds of Agent Attack Consoles Exposed Online (ARTEX Family)