Malte ZanderContents
Phishers copy learning platform login pages because those platforms hold many accounts with names, payment details and certificates, and because staff accounts often come with wide-ranging rights. Typical signs are lookalike domains with terms like campus, lms or login and emails such as "Your course access is about to expire". Training providers protect themselves with a single login address on their own domain, phishing-resistant login for staff, monitoring and fast takedowns.
- Logins are the main target: in Q4 2025, social media brands and SaaS and webmail providers were the most attacked sectors, at 20.3% each (APWG).
- In July 2025, Okta reported that attackers used the AI tool v0 to rebuild the login pages of several brands (Okta).
- Microsoft observed an adversary-in-the-middle campaign against more than 10,000 organizations that bypassed two-factor login by stealing session cookies (Microsoft).
- The US cybersecurity agency CISA classes app-based codes and push notifications with number matching as vulnerable to phishing (CISA).
Why do phishers target learning platforms?
Because a single login opens a lot. A learner account holds a name, an address, often payment details, course progress and certificates. A trainer or admin account often reaches participant lists, grades and platform settings. On top of that, training providers regularly send emails with links to many people. A fake email in the same tone hardly stands out.
For attackers, this is a familiar pattern. Logins are among the most attacked targets of all, and to learners a learning platform looks much like any other login page they only use now and then.
What does a fake LMS login look like?
Usually it is a near-perfect copy of your login page on someone else's domain. These are the typical features:
Domains with your name plus an add-on like campus, lms, login, portal or course, often with a different ending from your real address.
A lure by email or messenger: "Your course access is about to expire", "Your certificate is ready to download" or "Please confirm your invoice".
QR codes on printed materials or posters that lead to the copy instead of the real platform. See Quishing.
Proxy pages that relay your real platform live while capturing the password, code and session. Why two-factor login doesn't stop every phishing page explains why this works even with two-factor login.
AI-built copies that take minutes to create and are often hosted on trusted platforms.
How can learners and staff recognize the fake?
Above all by the address, and you should make that easy. Give them one rule they can remember: always open the platform from a bookmark or your website, never from a link in an email. A password manager helps too, because it does not autofill credentials on an unfamiliar domain. If it suddenly suggests nothing, that is a warning sign.
Cloned login pages shows more signs that give copies away.
What should providers do when a fake appears?
Act fast and in this order:
Capture evidence: the full link, screenshots, the lure email with headers, domain and hosting data. See Securing evidence of a fake website.
Frame it as phishing. Hosts give phishing reports top priority.
Report in parallel: host, registrar, DNS provider and Google Safe Browsing. The browser warning protects visitors before the page is gone, see Google Safe Browsing reports.
Secure accounts: reset passwords for affected accounts, end active sessions and check recent logins for unusual locations.
Inform learners clearly and without causing panic. How to warn customers about a fake website includes a template.
Involve data protection if accounts were taken over. Your data protection officer decides whether notification duties apply.
A fixed routine helps in the first hours, see Phishing in your name: a response plan for the first 24 hours.
How can you prevent it?
With five measures that make phishing harder and fakes easier to spot:
A single login address on your own domain, such as learn.your-brand.com. If your platform runs with a vendor, use your own domain if the vendor supports it.
Phishing-resistant login for staff. CISA names FIDO/WebAuthn and PKI-based methods as phishing-resistant. Start with accounts that have admin rights.
No login links in emails. Point people to the platform instead of linking directly to the login page. Then any email with a login link looks suspicious.
Monitoring for lookalike domains that combine your name with add-ons like campus, lms or login.
A reporting route on the login page where learners can report a suspicious link in one step.
One extra tip for your IT team: some copies load your logo or stylesheet straight from your server. Checking server logs for unfamiliar referrers can reveal such copies early.
How does AI Fraud Protect help?
AI Fraud Protect finds lookalike domains and cloned login pages of your learning platform. On a schedule, the domain scanner checks variants of your domains with typos, homoglyphs and add-ons like login, and through the report widget on your login page learners report a suspicious link in one step. The AI compares every finding with your real login page on desktop and mobile and names what was copied. Phishing has its own framing, the evidence package is compiled automatically, and every report to host, registrar, DNS provider and Google is reviewed and sent by a person.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedowns in the app.
FAQ
Does two-factor login protect against LMS phishing?
Only partly. Proxy pages can capture codes and session cookies in real time. Phishing-resistant methods such as FIDO/WebAuthn bind the login to the real domain and stop these attacks. For learners, a password manager is a good first step.
Our learning platform runs on the vendor's domain. Is that a problem?
It makes fakes harder to spot, because learners can barely tell a copy on a similar domain from the original. Use your own domain if the vendor allows it, and publish the exact address.
Do we have to inform learners if accounts were taken over?
It is often sensible and, depending on the case, a legal duty, for example under data protection law. Check with your data protection officer. This is not legal advice.
How fast does a takedown need to be?
As fast as possible. In a study of more than 286,000 phishing URLs, the median lifespan was just 5.46 hours (Lee et al.). So report to the host, registrar and Google Safe Browsing in parallel. The browser warning protects visitors while removal is underway.
Sources
APWG Phishing Activity Trends Report, Q4 2025, published 18 February 2026
Okta Threat Intelligence: v0 used to build phishing sites, 1 July 2025
Microsoft Security: from cookie theft to BEC, AiTM phishing as an entry point to financial fraud, 12 July 2022
CISA: Implementing phishing-resistant MFA, October 2022
Lee et al.: study on the lifespan of phishing pages, The Web Conference 2025