Anatomy of an Attack: The Payroll Pirates and the Power of Social Engineering

Anatomy of an Attack: The Payroll Pirates demonstrates how social engineering can bypass technical controls and cause real financial damage, with 36% of incidents Unit 42 engaged with beginning via social engineering, according to 2025 Unit 42 Global Incident Response Report: Social Engineering edition. The attacker impersonated employees to manipulate help desks for payroll, IT and HR, successfully resetting passwords and re-enrolling MFA devices after circumventing challenge/response authentication.

Social platforms and repeated callback attempts helped gather verification data, while the attacker registered an external email address as an authentication method in the client’s Azure AD to establish persistence for long‑term access.

Once inside the payroll system, multiple employee accounts were compromised and direct‑deposit details were modified to redirect paychecks to attacker‑controlled accounts, with three employee accounts ultimately affected before the incident was discovered via missing paychecks and an internal investigation. Unit 42’s response used Cortex XSIAM and NGFW logs to limit impact and remove the fraudulent payroll changes, and the investigation also noted a WannaCry foothold in the client’s legacy OT environment. Published 16 January 2026.