Investigating targeted “payroll pirate” attacks affecting US universities

According to Microsoft Threat Intelligence, a financially motivated threat actor tracked as Storm-2657 has been compromising employee accounts to access HR SaaS platforms like Workday and divert salary payments, a campaign described as payroll fraud targeting US universities.

Microsoft Threat Intelligence has observed a campaign in the first half of 2025 in which 11 accounts across three universities were compromised to send phishing emails to nearly 6,000 email accounts across 25 universities, beginning from March 2025. The attackers used adversary-in-the-middle phishing to harvest MFA codes, gained access to Exchange Online, and then hijacked Workday profiles to modify payroll and bank details, with some emails attempting to hide changes by creating inbox rules.

The research notes that these attacks exploit a lack of MFA resilience, and that the workarounds do not reflect a vulnerability in Workday itself but rather social engineering and MFA weaknesses. Mitigation emphasises phishing-resistant MFA and passwordless options, plus prompt remediation steps such as resetting credentials, re-registering MFA, and removing malicious inbox rules.

The analysis also highlights the value of Defender for Cloud Apps and related tooling to detect and disrupt this activity across Workday and Exchange Online.