Payroll Piracy: Hackers Storm-2657 Exploit MFA Flaws to Hijack University Salary Payments via Workday

Microsoft Threat Intelligence has issued a warning about a financially motivated campaign conducted by a threat actor tracked as Storm-2657, dubbed by researchers as a “payroll pirate.” The group has been compromising employee accounts at U.S. universities to divert salary payments into attacker-controlled bank accounts, with the operation observed during the first half of 2025 and relying heavily on social engineering and phishing emails designed to steal MFA codes through adversary-in-the-middle phishing links.

According to Microsoft, these attacks target a range of US-based organisations, particularly employees in sectors like higher education, to gain access to third-party HR SaaS platforms like Workday; after access is gained, they hijack Exchange Online accounts and modify victims’ Workday payroll profiles to reroute salaries. They do not represent a vulnerability in the Workday platform itself.

Since March 2025, 11 compromised accounts across three universities were used to send nearly 6,000 phishing emails to employees at 25 institutions. After compromising accounts, Storm-2657 set up inbox rules to delete Workday notification emails and, in several cases, added their own phone numbers as MFA devices to maintain access.

Authorities suggest organisations detect intrusions by correlating signals between Exchange Online and third-party SaaS systems like Workday and by employing phishing-resistant MFA, auditing logs for suspicious changes, and using Microsoft Defender for Cloud Apps to trace malicious inbox rules and payroll edits.