“Payroll Pirate” phishing scam that takes over Workday accounts steals paychecks

Microsoft is warning of an active scam dubbed “Payroll Pirate” that takes over Workday or other cloud-based HR accounts and diverts paychecks to attacker-controlled accounts after first compromising the victims’ profiles. The attackers bypass multi-factor authentication by using adversary-in-the-middle tactics, then enter the intercepted credentials and MFA code into the real site, enabling access to payroll configurations within Workday to redirect direct-deposit payments.

They also create email rules to hide notifications about account changes and, in some cases, add a controlled phone number as a backup recovery option to maintain persistence. Since March 2025, Microsoft says 11 accounts at three universities have been compromised to send phishing emails to nearly 6,000 email accounts across 25 universities, with the threat actor described as having used realistic phishing emails.

To date, there have been no known instances of FIDO MFA falling to such scams, according to Microsoft, and the warning notes that end-user or cloud-based systems already compromised can undermine protections, so organisations should review email filtering rules for security notices from Workday or other services.