Rising Payroll Scams Targeting US Universities in 2025

Rising Payroll Scams Targeting US Universities in 2025

Phishing scams affect a variety of institutions, including hospitals, tech firms, and even fast-food chains. Unfortunately, educational establishments are not exempt. As of 2025, a worrying trend has emerged where universities across the U.S. face targeted cybercrimes aimed at hijacking salary payments. Researchers have identified a hacking collective known as Storm-2657, which has been executing “pirate payroll” attacks since March 2025, relying on sophisticated phishing tactics to gain access to payroll accounts.

In this article, we will delve deeper into these attacks and explore actionable steps you can take to safeguard your information.

Understanding the Attack Tactics of Storm-2657

According to Microsoft Threat Intelligence, Storm-2657 primarily sets its sights on Workday, a popular human resources platform. However, other payroll and HR software may also be vulnerable. The attackers initiate their scheme with highly convincing phishing emails, meticulously crafted to resonate with individual staff members.

Some emails create a sense of urgency, warning about a sudden campus illness outbreak. Others may state that a faculty member is under investigation, prompting recipients to check documents immediately. In several cases, these emails impersonate the university president or the HR department, purporting to share crucial updates regarding compensation and benefits.

Phishing Mechanics: How Attackers Steal Information

These deceitful emails often contain links designed to capture login credentials and multi-factor authentication codes in real time, employing adversary-in-the-middle techniques. When an employee enters their information, the attackers gain access to the account as though they are the legitimate user.

Once they seize control, hackers implement inbox rules to delete Workday notifications, which may alert victims to any atypical changes. This stealthy tactic enables the attackers to modify payroll profiles, alter salary payment settings, and reroute funds to accounts they control, all while evading immediate suspicion.

Extending the Attack: A Ripple Effect

However, the hackers do not confine their operations to a single account. After compromising one mailbox, they use it to propagate the attack further. Microsoft reports that from just 11 compromised accounts at three universities, Storm-2657 dispatched phishing emails to nearly 6,000 email addresses across 25 institutions. Leveraging trusted internal accounts makes their emails appear more credible, thereby increasing the likelihood that recipients will fall victim to the scam.

To ensure ongoing access, attackers sometimes register their own phone numbers as multi-factor authentication devices, either through work profiles or through Duo MFA. This grants them continuous access, enabling them to approve further malicious activities without needing to resort to phishing again.

Determining the Source of Vulnerability

Microsoft emphasizes that these attacks do not exploit any flaws within Workday itself. Instead, they capitalize on social engineering tactics, the lack of robust phishing-resistant multi-factor authentication, and meticulous manipulation of internal systems. Ultimately, this threat arises from human behavior and insufficient protective measures, rather than software bugs.

Empowering Yourself Against Payroll and Phishing Scams

Protecting against payroll scams and phishing does not need to be complex. By taking some diligent precautions, you can significantly reduce the likelihood of attackers gaining access to your accounts or personal details.

The more information that scammers can obtain about you, the easier it becomes for them to create convincing phishing messages. Utilizing services that monitor and remove personal data from the internet can help diminish your exposure, making it more difficult for attackers to craft targeted emails.

The Importance of Data Removal Services

While obtaining absolute removal of your information from the internet is unrealistic, employing data removal services represents a strategic investment. They offer a comprehensive solution by actively monitoring and systematically eliminating your personal data from countless websites. This effort not only brings peace of mind, but it also proves to be one of the most efficient methods for protecting your personal data. The less information available, the more challenging it becomes for scammers to correlate data with information they might find on the dark web.

Stay Vigilant: Recognizing Phishing Attempts

Cybercriminals often send emails that mimic your HR department or university leadership, raising alarms about payroll, benefits, or urgent matters. It is crucial not to click links or download attachments unless you can verify their legitimacy. Even minor missteps can provide attackers with access to your accounts.

The most effective way to secure yourself against malicious links is to install reputable antivirus software on all your devices. This protective measure can alert you to phishing emails and ransomware threats, safeguarding both your personal information and digital assets.

Taking Proactive Measures

When you receive an email mentioning salary changes or requiring action, reach out to the HR office or the individual directly using known contact information. Phishing emails are designed to induce panic and prompt hasty decisions; hence, taking a moment to confirm the email’s legitimacy can thwart attackers.

Avoid reusing passwords across different accounts, as scammers frequently attempt to exploit credentials stolen from other breaches. Utilizing a password manager can help you generate robust passwords and store them securely, eliminating the need to remember a myriad of different combinations.

Additional Security Tips

Look into whether your email has been compromised in previous breaches. A quality password manager often includes built-in breach scanning, enabling you to determine whether your email address or passwords have appeared in known leaks. If you find a match, promptly change any reused passwords and secure those accounts with unique credentials.

Enabling two-factor authentication on all accounts that support it serves as an extra layer of security. Even if a hacker procures your password, they cannot access your account without a secondary verification step, such as a code sent to your mobile device.

Even with all the necessary precautions in place, monitoring your accounts for unusual activities remains a wise strategy. Recognizing unauthorized transactions promptly can avert substantial losses and alert you to potential scams before they escalate.

The Ongoing Threat of Cybercrime

The Storm-2657 payroll attacks illustrate that cybercriminals are increasingly targeting trust rather than exploiting software vulnerabilities. Universities are particularly appealing targets because payroll systems handle financial transactions directly. Moreover, staff members can be manipulated through expertly crafted phishing schemes. The scale and sophistication of these attacks encompass a critical reminder of the vulnerabilities present even in well-established institutions.

How often do you check your payroll or bank accounts for signs of unusual activity? Your insights could help others navigate this growing threat.