Microsoft Warns of ‘Payroll Pirates’ Hijacking HR SaaS Accounts to Steal Employee Salaries

According to Microsoft Threat Intelligence, a threat actor known as Storm-2657 has been observed hijacking employee accounts to divert salary payments, targeting United States organisations including higher education institutions that use HR SaaS platforms such as Workday.

The attacks rely on social engineering and MFA gaps rather than flaws in the services themselves, with techniques like adversary-in-the-middle phishing to harvest credentials and MFA codes and gain access to Exchange Online and Workday profiles via SSO. Microsoft said 11 compromised accounts at three universities were used to send phishing emails to nearly 6,000 accounts across 25 universities, with messages attempting to lure recipients into clicking on malicious links.

The campaign also involved creating inbox rules to hide unauthorized changes and enrolling threat actors’ own numbers as MFA devices to maintain access, while compromised accounts distributed further phishing internally and to other universities. To mitigate the risk, the advisory recommends passwordless, phishing-resistant MFA such as FIDO2 security keys and vigilance for suspicious activity across HR SaaS accounts.