“Payroll Pirates” – Microsoft warns of hackers stealing university paychecks in new cyber scam

Imagine waking up in the morning to find your hard-earned money gone to a hacker. This terrifying scenario is proving true for university employees across the United States, thanks to a cunning cybercrime gang called Storm2657. Since March 2025, these digital thieves have been hijacking payroll systems in what Microsoft calls a payroll pirate attack, leaving a trail of financial devastation in their wake.

But this is where things get even more dangerous. These attacks aren’t just about stealing money. They’re adept at exploiting human trust and technical vulnerabilities. Microsoft’s threat intelligence analysts first spotted this campaign targeting Workday accounts, a popular HR software as a service (SAAS) platform.

How Attackers Trick Employees: The MFA Phishing Scam

A sophisticated cybercrime campaign is quietly raiding the payrolls of universities across the United States. Since March 2025, a hacking group tracked by Microsoft as Storm2657 has been targeting university employees in what they call pirate payroll attacks, stealing salaries by sending them to accounts they control.

Microsoft’s threat intelligence team uncovered the campaign and stated that the attackers are primarily targeting Workday accounts, a popular human resources and payroll platform used by major universities. So far, at least 11 accounts from three universities have been confirmed to have been compromised.

Those hijacked accounts were then used to send phishing emails to approximately 6,000 other university employees at 25 institutions. Here’s the catch: This isn’t a flaw in Workday. Microsoft clarified that the platform itself was not breached. Instead, the attackers used advanced social engineering to exploit employees who weren’t using multifactor authentication or were using weak versions that could be bypassed.

These fishing traps were extremely convincing. Fake emails warned of a campus disease outbreak, reports of faculty misconduct, and even messages purporting to be from university presidents regarding salary changes or human resources updates. Clicking on the links would take victims to fake login pages where the attackers, using malicious tools, would intercept usernames, passwords, and even MFA codes in real-time.

Once they had infiltrated a victim’s account, the hackers moved quickly. They set hidden rules in the inbox that automatically delete security alerts from Workday, masking any suspicious activity. They then accessed the victim’s payroll profile through single sign-on and quietly changed where the individual’s paycheck was deposited.

In many cases, Microsoft found that hackers had also added their phone numbers to MFA systems like Duo or Workday, so they could re-enter the accounts later and continue the fraud without being detected. The stolen salaries were sent to accounts controlled by the attackers, often through money mules or prepaid banking services.

Meanwhile, the compromised email accounts were used to launch further phishing waves, spreading the infection to universities across the country. Microsoft has notified the affected institutions and is assisting with containment. The company has urged all organizations using HR SaaS platforms like Workday to enable anti-phishing MFA, regularly audit mailbox rules, and monitor for unusual changes to payroll details.

Payroll pirate attacks like these are part of a growing wave of business email compromise, or BEC scams, which the FBI says are now one of the most damaging forms of cybercrime. In 2024 alone, more than 21,000 BEC victims reported losses of over $2.7 billion. But this is just a small fraction, as many victims don’t realize they’ve suffered losses until payday arrives and the money is gone.

Key Takeaways

• If MFA isn’t phishing-resistant, it alone may not be sufficient.
• Always verify email senders, especially emails with links or attachments, even if they appear legitimate.
• Employees should be trained to recognize phishing tactics, including impersonation of officials or fear-based messages.
• Organizations should implement monitoring and alerting systems to detect unusual payroll or account activity.

The Storm2657 payroll pirate attacks are a stark reminder that cybersecurity isn’t just about technology, but also about human awareness. By staying vigilant and implementing multi-layered security measures, universities and businesses can protect themselves from these sophisticated attacks.

Frequently Asked Questions (FAQs)