Microsoft Warns US Universities Of Alarming Payroll Pirate Attack Security Threat
Microsoft Threat Intelligence has been investigating the attacks since March 2025, noting that the threat actor gained initial access through highly believable and targeted phishing emails. The emails often employed convincing social engineering methods of impersonating official university communications, like messages from a university president or urgent alerts about compensation and benefits changes.
Other lures included fabricated warnings about illnesses/outbreaks on campus or classroom misconduct reports to entice users into clicking. The emails frequently contained links to a Google Docs page that redirected the victim to an attacker-controlled site designed to harvest their credentials and multi-factor authentication (MFA) codes.
Microsoft found that the lack of strong MFA was a key vulnerability exploited by the hackers. In observed instances some compromised accounts did not have MFA enabled at all, or where users were tricked into giving up their one-time codes via an adversary-in-the-middle (AiTM) phishing link. Once Storm-2657 successfully compromised an employee's account, they moved swiftly and stealthily to make off with the paycheck.
Microsoft reported that since March 2025, it's observed 11 successfully compromised accounts across three universities, which were then leveraged to send phishing emails to nearly 6,000 email accounts across 25 different institutions.
While the attacks don't represent a vulnerability in the HR platforms themselves, they highlight the critical need for educational institutions to strengthen their identity protection. Experts emphasize the importance of adopting phishing-resistant MFA methods and implementing stricter, step-up verification for highly sensitive transactions like changing direct deposit information, for example.
Also, as best practice, never click a link in an unexpected email that asks for your login credentials or MFA code, and be vigilant about any communication that invokes a sudden sense of urgency or fear. If a payroll notification seems suspicious, verify the information directly through the official HR portal, not by clicking a link in the email.
