Payroll Pirate Phishing Attacks Targeting US University Employees

Cybercriminals identified as 'payroll pirates' have launched a targeted phishing campaign against US universities, aiming to divert salary payments from employees to accounts under their control. Microsoft Threat Intelligence reported that since March 2025, at least 11 accounts across three universities were successfully compromised, with phishing emails sent to nearly 6,000 recipients at 25 different universities. The attackers primarily targeted third-party platforms such as Workday, which are commonly used for HR and payroll management in higher education institutions. The phishing emails often contained malicious links and were crafted to steal multifactor authentication (MFA) codes, enabling the attackers to bypass security measures and hijack employee accounts. Once inside a compromised account, the threat actors established inbox rules to automatically delete warning emails from Workday, thereby concealing unauthorized changes to bank account information. This allowed the attackers to redirect salary payments without immediate detection by the victims. The phishing lures were varied, with some emails referencing COVID-19 exposure or faculty misconduct, and often included links to Google Docs to increase credibility. In one instance, a phishing email about illness exposure was sent to 500 individuals at a single organization. Microsoft attributed the campaign to a group it tracks as Storm-2657 and has proactively contacted affected customers with mitigation advice. The campaign demonstrates a sophisticated understanding of university HR processes and leverages social engineering themes relevant to academic environments. The attackers' use of MFA code theft highlights the evolving tactics used to bypass common security controls. Microsoft emphasized that while Workday was a primary target, other HR and payment systems could also be at risk. The scale of the campaign, with thousands of potential victims, underscores the need for heightened vigilance and improved security awareness among university staff. The incident has raised concerns about the security of third-party platforms used for payroll and HR functions in the education sector. Workday, the platform most frequently targeted, did not respond to requests for comment regarding the incident. Microsoft’s response included sharing technical indicators and recommended best practices to help organizations defend against similar attacks. The campaign is ongoing, and universities are urged to review their security protocols, especially around MFA and email filtering. The incident highlights the persistent threat of phishing and the importance of layered security defenses in protecting sensitive financial information.