security: Investigating targeted “payroll pirate” attacks affecting US universities
Microsoft Security Blog
2025-10-09
Microsoft Threat Intelligence reports a financially motivated actor tracked as Storm-2657 conducting "payroll pirate" attacks against US universities by compromising employee accounts, accessing employee profiles, and diverting salary payments to attacker-controlled accounts.