{"id":223191,"date":"2025-10-10T05:14:49","date_gmt":"2025-10-10T10:14:49","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2025\/10\/microsoft-hackers-target-universities-in-payroll-pirate-attacks"},"modified":"2025-10-10T05:14:49","modified_gmt":"2025-10-10T10:14:49","slug":"microsoft-hackers-target-universities-in-payroll-pirate-attacks","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2025\/10\/microsoft-hackers-target-universities-in-payroll-pirate-attacks","title":{"rendered":"Microsoft: Hackers target universities in \u201cpayroll pirate\u201d attacks"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/microsoft-hackers-target-universities-in-payroll-pirate-attacks.jpg\"><\/a><\/p>\n<p>A cybercrime gang tracked as Storm-2657 has been targeting university employees in the United States to hijack salary payments in \u201cpirate payroll\u201d attacks since March 2025.<\/p>\n<p>Microsoft Threat Intelligence analysts who spotted this campaign found that the threat actors are targeting Workday accounts; however, other third-party human resources (HR) software-as-a-service (SaaS) platforms could also be at risk.<\/p>\n<p>\u201cWe\u2019ve observed 11 successfully compromised accounts at three universities that were used to send phishing emails to nearly 6,000 email accounts across 25 universities,\u201d <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2025\/10\/09\/investigating-targeted-payroll-pirate-attacks-affecting-us-universities\/\" target=\"_blank\" rel=\"nofollow noopener\">Microsoft said<\/a> in a Thursday report.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A cybercrime gang tracked as Storm-2657 has been targeting university employees in the United States to hijack salary payments in \u201cpirate payroll\u201d attacks since March 2025. Microsoft Threat Intelligence analysts who spotted this campaign found that the threat actors are targeting Workday accounts; however, other third-party human resources (HR) software-as-a-service (SaaS) platforms could also be [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34],"tags":[],"class_list":["post-223191","post","type-post","status-publish","format-standard","hentry","category-cybercrime-malcode"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/223191","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=223191"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/223191\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=223191"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=223191"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=223191"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}