Subdomain Takeover is a attack_type tracked across 1 threat cluster and 1 intelligence report mention on ThreatCluster. First observed April 20, 2026; most recent activity April 20, 2026.
In early April 2026, a coordinated subdomain takeover campaign was discovered, affecting 34 major US universities, including MIT, Harvard, and Stanford. The attackers, identified as Hazy Hawk, exploited abandoned CNAME…