Facepalm: As artificial intelligence becomes more sophisticated, a new breed of scam is quietly siphoning millions from the US higher education system. Cybercriminals are using AI-driven bots to impersonate students, enroll in online college courses, and divert financial aid, leaving real individuals with stolen identities and fraudulent debt.

One San Francisco resident, Heather Brady, learned the hard way how sophisticated education scams have become. A police officer showed up at her home with an unexpected question about her alleged college enrollment in Arizona. Brady had never applied ,but someone else had used her personal information to secure government aid.

Later, she discovered a student loan for more than $9,000 had been issued in her name for classes she never attended. “I just can’t imagine how many people this is happening to that have no idea,” Brady told The Associated Press.

The problem is escalating rapidly as online classes grow more widespread and AI tools make it easier for scammers to automate the entire process. These so-called “ghost students” can complete applications, enroll in classes, participate in coursework, and even submit assignments without a human ever being involved. In some cases, instructors have found that almost none of their students are genuine, with legitimate learners locked out of required classes because bots filled all the available slots.

The financial toll is substantial. In 2024, California’s community colleges reported 1.2 million suspicious applications, leading to over 220,000 likely fraudulent enrollments, according to data obtained by the Associated Press. The system lost at least $11.1 million in unrecoverable financial aid last year alone. Community colleges are particularly vulnerable, as their lower tuition means a greater portion of grant and loan funds goes directly to students for living expenses.

Wayne Chaw, who once took classes at De Anza Community College, was notified about a course he never signed up for. Thieves had used his Social Security number to claim nearly $1,400 in aid, and someone – likely an AI bot – was submitting homework under his name. “This person is typing as me, saying my first and last name. … It’s very freaky when I saw that,” Chaw said.

For victims, unraveling the damage is a long and frustrating ordeal. Brittnee Nelson, a small business owner in Louisiana, discovered that loans had been taken out in her name for schools she never attended. Despite diligently monitoring her credit and safeguarding her identity, she spent two years working to remove the fraudulent debt. “It’s like if someone came into your house and robbed you,” Nelson said.

Colleges say they often lack the power to prevent these scams. Delgado Community College in New Orleans, for example, emphasized that the ultimate authority for loan approval lies with federal agencies. “This is an unfortunate and serious matter, but it is not the direct or indirect result of Delgado’s internal processes,” said spokesperson Barbara Waiters.

In response to the surge in fraud, the US Department of Education recently enacted a temporary measure requiring first-time federal aid applicants to verify their identity with a government-issued ID. The department acknowledged the severity of the threat, stating, “The rate of fraud through stolen identities has reached a level that imperils the federal student aid program.” More robust screening is expected to follow.

While the government scrambles to tighten security, its capacity to investigate and resolve fraud is shrinking. Recent layoffs and staff attrition at key federal offices have left fewer personnel available to assist victims and pursue scammers. Brady, still facing the prospect of a $9,000 debt she never incurred, fears that help may never come. “The agency is going to be so broken down and disintegrated that I won’t be able to do anything, and I’m just going to be stuck” she said.

Recent prosecutions illustrate the scale of the problem. They include a Texas man accused of orchestrating a $1.5 million aid fraud, another individual in Texas admitting to using inmates’ names to claim more than $650,000, and a New York resident pleading guilty to a decade-long, $450,000 scam.

As AI-powered schemes continue to evolve, students and taxpayers remain at risk. Nelson believes stronger identity checks are essential. “If they can make these hurdles a little bit harder and have these verifications more provable, I think that’s really, really, really going to protect people in the long run,” she said.

A hot potato: The resurgence of BadBox 2.0 poses new risks that consumers should be aware of. As unregulated, low-cost IoT devices become increasingly common in households around the world, it’s essential to understand the potential dangers they present.

A new wave of cyberattacks is targeting household technology, as the FBI has issued a warning about the resurgence of the BadBox 2.0 botnet. This sophisticated network of compromised Internet of Things devices is being exploited by cybercriminals to infiltrate home networks on a massive scale, raising fresh concerns about the security of everyday smart devices. The campaign’s global footprint spans more than 220 countries and territories, with infections reported in everything from budget streaming boxes to uncertified digital photo frames.

The original BadBox operation first came to light in 2023, when security researchers discovered that certain Android-based devices – primarily off-brand, low-cost gadgets not certified by Google Play Protect – were being sold with malware embedded directly in their firmware. These devices, often manufactured in China and shipped worldwide, included streaming boxes, digital projectors, and even vehicle infotainment systems.

While the initial BadBox campaign was partially disrupted in 2024 through coordinated action by cybersecurity firms, tech companies, and international law enforcement (including a joint operation between German authorities and Google), the threat quickly adapted. The botnet evolved to bypass many of the countermeasures deployed against it, signaling a dangerous new phase in IoT-focused cybercrime.

BadBox 2.0, the latest iteration of the botnet, has proven even more insidious than its predecessor. While the original version primarily infected devices during manufacturing, BadBox 2.0 can compromise hardware both at the factory and after it reaches consumers. Devices may arrive with firmware-level backdoors already installed or become infected during initial setup if users download apps from unofficial marketplaces.

Security analysts have identified at least four interconnected groups behind the botnet – SalesTracker, MoYu, Lemon, and LongTV – each specializing in a different phase of the operation, from malware distribution to monetizing stolen data.

Once a device is compromised, it becomes part of a sprawling botnet. Cybercriminals use these infected endpoints as residential proxies, allowing them to route illicit activity through home networks and obscure their true origins. In addition to facilitating ad fraud and DDoS attacks, the botnet enables credential stuffing to hijack online accounts, intercepts one-time passwords for financial fraud, and deploys malicious code to further expand its network. The malware’s ability to execute arbitrary commands gives attackers the flexibility to repurpose infected devices for virtually any cybercriminal goal.

The roots of BadBox trace back to earlier malware such as Triada, a sophisticated Android Trojan first discovered in 2016. Triada was known for deeply embedding itself into systems and evading detection. Over the years, its tactics have evolved into the modern supply chain attacks seen in BadBox and BadBox 2.0. This lineage helps explain the botnet’s resilience and adaptability, built on nearly a decade of development and refinement.

Detecting a BadBox 2.0 infection is difficult for most consumers. The malware typically operates silently, with few obvious symptoms. Subtle signs may include the appearance of unfamiliar app stores, unexplained device overheating, or sudden changes to network settings. The FBI warns that devices advertising free access to premium content or marketed as “unlocked” pose a particularly high risk.

If a device is suspected of being infected, users should isolate it from the internet immediately, review all connected devices for unauthorized apps or activity, and consider performing a full reset or replacing the hardware.

To minimize risk, experts recommend:

• Purchasing devices certified by Google Play Protect.

• Avoiding uncertified or off-brand hardware.

• Keeping firmware and apps updated.

• Monitoring home network traffic for anomalies.

• Checking security bulletins for compromised model lists and known indicators of compromise.