Microsoft warns of latest “Payroll Pirate” rip-off stealing workers’ direct deposits

Microsoft is warning of an lively rip-off that diverts workers’ paycheck funds to attacker-controlled accounts after first taking on their profiles on Workday or different cloud-based HR companies.

Payroll Pirate, as Microsoft says the marketing campaign has been dubbed, good points entry to victims’ HR portals by sending them phishing emails that trick the recipients into offering their credentials for logging in to the cloud account. The scammers are capable of get better multi-factor authentication codes through the use of adversary-in-the-middle techniques, which work by sitting between the victims and the positioning they suppose they’re logging in to, which is, the truth is, a pretend web site operated by the attackers.

Not all MFA is created equal

The attackers then enter the intercepted credentials, together with the MFA code, into the true web site. This tactic, which has grown more and more widespread in recent times, underscores the significance of adopting FIDO-compliant types of MFA, that are proof against such assaults.

As soon as inside the staff’ accounts, the scammers make adjustments to payroll configurations inside Workday. The adjustments trigger direct-deposit funds to be diverted from accounts initially chosen by the worker and as a substitute circulation to an account managed by the attackers. To dam messages Workday robotically sends to customers when such account particulars have been modified, the attackers create e mail guidelines that maintain the messages from showing within the inbox.

“The risk actor used real looking phishing emails, focusing on accounts at a number of universities, to reap credentials,” Microsoft mentioned in a Thursday publish. “Since March 2025, we’ve noticed 11 efficiently compromised accounts at three universities that had been used to ship phishing emails to almost 6,000 e mail accounts throughout 25 universities.”