MS-ISAC flagged leaked credentials at 808 K-12 organisations and traced attacks spreading through genuine staff mailboxes.