The attacks used false university domains and focused on credential harvesting and financial theft.