Hackers Exploit Microsoft Employee Accounts in Salary Theft Scheme

Microsoft Threat Intelligence is sounding the alarm about a surge of payroll theft attacks in which financially motivated adversaries hijack employee accounts to reroute salary payments to attacker‑controlled bank accounts. In the first half of 2025, the threat actor Storm-2657 launched a widespread phishing campaign against university staff, harvesting credentials and MFA codes.

Eleven employee accounts across three universities were compromised and used to send over 6,000 phishing emails to 25 institutions, with attackers bypassing account protections after disabling incoming Workday notifications and altering payroll configurations. They gained persistence by enrolling personal phone numbers as MFA devices and moved to intercept paychecks by changing bank details within Workday profiles.

Microsoft recommends phishing‑resistant MFA such as FIDO2 security keys or Windows Hello for Business, alongside monitoring with Defender for Cloud Apps and Sentinel to detect bulk phishing and payroll changes. This underscores the need for stronger authentication across privileged and HR-facing roles and coordinated defences between Microsoft and Workday to safeguard employee compensation from evolving payroll pirate schemes. 10 October 2025