+- Hack Forums (https://hackforums.net)
+-- Forum: General Topics (https://hackforums.net/forumdisplay.php?fid=7)
+--- Forum: World (https://hackforums.net/forumdisplay.php?fid=445)
+---- Forum: News and Happenings (https://hackforums.net/forumdisplay.php?fid=89)
+---- Thread: Microsoft Warns of Payroll Pirates Hijacking HR SaaS Accounts to Steal Employe (/showthread.php?tid=6311715)
Microsoft Warns of Payroll Pirates Hijacking HR SaaS Accounts to Steal Employe - Stanley - Oct 20, 2025
Microsoft Warns of ‘Payroll Pirates’ Hijacking HR SaaS Accounts to Steal Employe
A threat actor known as Storm-2657 has been observed hijacking employee accounts with the end goal of diverting salary payments to attacker-controlled accounts.
"Storm-2657 is actively targeting a range of U.S.-based organizations, particularly employees in sectors like higher education, to gain access to third-party human resources (HR) software as a service (SaaS) platforms like Workday," the
https://thehackernews.com/2025/10/microsoft-warns-of-payroll-pirates.html
RE: Microsoft Warns of Payroll Pirates Hijacking HR SaaS Accounts to Steal Employe - Mix - Oct 20, 2025
Interesting aproach to such a easy to detect action. I know a friend of mine has workday at there job so will hope the best for them to not be targeted.
RE: Microsoft Warns of Payroll Pirates Hijacking HR SaaS Accounts to Steal Employe - Vectura - Oct 20, 2025
That’s wild but not really shocking. HR platforms are basically treasure chests for attackers, personal data, payroll info, everything in one place. Companies really need to stop treating SaaS security like an afterthought.
RE: Microsoft Warns of Payroll Pirates Hijacking HR SaaS Accounts to Steal Employe - Mix - Oct 20, 2025
(Oct 20, 2025 06:12 PM)Vectura Wrote: That’s wild but not really shocking. HR platforms are basically treasure chests for attackers, personal data, payroll info, everything in one place. Companies really need to stop treating SaaS security like an afterthought.
I find it funny when companys think they dont need to worry about paying for a secrue HR system. 🤣
RE: Microsoft Warns of Payroll Pirates Hijacking HR SaaS Accounts to Steal Employe - Oh_Well - Oct 21, 2025
HRs are most of the times easy targets, those guys have no idea about tech
RE: Microsoft Warns of Payroll Pirates Hijacking HR SaaS Accounts to Steal Employe - Chorozon - Oct 21, 2025
Most of the new SaaS admins are vibe coders so i can see this becoming more of a thing
RE: Microsoft Warns of Payroll Pirates Hijacking HR SaaS Accounts to Steal Employe - Rsynced - Oct 22, 2025
Well this is a new phrase I just learned today "Payroll Pirates"🤦♂️
RE: Microsoft Warns of Payroll Pirates Hijacking HR SaaS Accounts to Steal Employe - DAL-SHA - Oct 22, 2025
Wow !! Even HR platforms are now prime targets for smart attackers.
Some one has a history with HR Departments !! 🤣🤣
RE: Microsoft Warns of Payroll Pirates Hijacking HR SaaS Accounts to Steal Employe - Mix - Oct 22, 2025
(Oct 22, 2025 01:31 PM)Dalsha Wrote: Wow !! Even HR platforms are now prime targets for smart attackers.
Some one has a history with HR Departments !! 🤣🤣
They have always been a target but now with AI snooping around to find ways around it all it hasnt been easier.
RE: Microsoft Warns of Payroll Pirates Hijacking HR SaaS Accounts to Steal Employe - Eran - Oct 23, 2025
(Oct 22, 2025 01:31 PM)Dalsha Wrote: Wow !! Even HR platforms are now prime targets for smart attackers.
Some one has a history with HR Departments !! 🤣🤣
HR platforms are one of the easiest to attack imho.
RE: Microsoft Warns of Payroll Pirates Hijacking HR SaaS Accounts to Steal Employe - DAL-SHA - Oct 23, 2025
(Oct 23, 2025 03:45 AM)TRS Wrote: HR platforms are one of the easiest to attack imho.
Just because they contain a lot of info about the company workers or private info you think ??? 🕵️🕵️
RE: Microsoft Warns of Payroll Pirates Hijacking HR SaaS Accounts to Steal Employe - Hackers - Oct 26, 2025
This makes sense, manager comps get infected & then used to send payments out for whatever funds that user has access to.
You could also trigger change requests that look innocent enough for another supervisor to approve i guess?
RE: Microsoft Warns of Payroll Pirates Hijacking HR SaaS Accounts to Steal Employe - leste - Oct 30, 2025
Interesting that they're targeting employees in the higher education sector.