Look out for the Zoho Assist "Student Report" Scam

By: Zachary Beese, IT Security Manager
August 3, 2026

Share this Article

A fraudulent email recently seen in campus inboxes claims that "President David Cook has shared a document concerning a student report submitted by a parent or guardian." The message attempts to create a sense of urgency and encourages recipients to download a file that ultimately launches a Zoho Assist remote access session.

While Zoho Assist is a legitimate remote support tool, cybercriminals are misrepresenting the software to gain unauthorized access to a computer. If successful, the scam gives an attacker the ability to view your information, install software, capture credentials, or take other actions on your device.

Target Audience

This phishing email primarily targets faculty members teaching summer courses.

How It Works

  • The email claims a student report requires immediate review and includes links to an attached document and a file labeled "ZA Access My Department." 
  • Recipients are instructed to download the file, open it, and approve a Zoho Assist window by clicking "Next," "I Agree," and other prompts until the installation is complete.
  • The goal is not to share a student report. The goal is to convince the recipient to install software that establishes a remote connection to the computer. 
  • What happens if you fall for it: Once access is granted, an attacker may be able to control the device and access sensitive information. IT employees at the universit will have to remove the harmful software from your university-owned device.

Red Flags

  • The email uses the name of President David Cook to create a false sense of authority.
  • It references a vague "student report" without providing context, case information, or a legitimate university process.
  • The “student report” is outside of Workday, ISU’s student information system of record.
  • The email contains inconsistent wording, such as references to a "statement" rather than a student report.
Phishing email sample

Meet the Contributors

Zachary Beese helps protect Iowa State University's digital environment as a member of the Information Technology Services (ITS) security team. As Manager of Information Security, he works to safeguard university systems, respond to cybersecurity threats, review security risks and support campuswide efforts to keep information secure. Working on the front lines of cybersecurity incident response, he direct exposure to the fraudulent emails, phishing campaigns and social engineering attacks that target university users.

Rich Tener helps lead Iowa State University's efforts to protect its digital environment as Chief Information Security Officer in Information Technology Services (ITS). He works with campus partners to strengthen cybersecurity practices, manage security risks and guide the university's response to emerging threats. He and members of the ITS Security team help shape the strategies, policies and initiatives that keep university systems and information secure. 

Test Button