ForumTroll Phishing Campaign Uses Fake eLibrary Emails to Target Academic Researchers

Attackers are sending convincing eLibrary-themed phishing emails to steal credentials from scholars and research institutions.

Security researchers have identified a new phishing campaign known as ForumTroll that targets academic researchers using fraudulent emails designed to imitate eLibrary notifications. The campaign relies on social engineering rather than technical exploits, which makes it highly effective against busy scholars.

The phishing emails appear professional and closely resemble legitimate eLibrary communications. They often reference new citations, document access requests, or account-related issues. As a result, recipients feel compelled to click embedded links to review the supposed update.

These links redirect users to fake login pages that closely mimic the real eLibrary portal. Once victims enter their credentials, attackers immediately capture the information. The stolen credentials can then grant access to academic accounts, institutional email systems, and connected research platforms.

Researchers analyzing the campaign note that ForumTroll demonstrates a strong understanding of academic workflows. The emails use familiar terminology and timing that aligns with research and publication cycles. Therefore, even experienced academics may struggle to identify the deception.

The risks extend beyond individual account compromise. Academic platforms often integrate with internal systems and shared resources. Consequently, attackers may leverage stolen credentials to move laterally, access sensitive research data, or launch follow-on phishing attacks from trusted accounts.

Security experts recommend verifying the sender and destination URLs before interacting with academic-related emails. Institutions should enforce multi-factor authentication and deploy advanced email filtering to reduce exposure. Regular phishing awareness training also helps users recognize subtle warning signs.

Overall, the ForumTroll campaign highlights how attackers increasingly target research communities. As academic environments continue to digitize workflows, strong identity protection and user awareness remain critical defenses.