Pirate Payroll Pandemonium: How Storm-2657 is Hijacking University Paychecks in the U.S.
Storm-2657 has been hijacking university payrolls since March 2025, using pirate payroll tactics. These cyber marauders exploit the absence of multifactor authentication to commandeer salaries, while sending phishing emails about faculty misconduct or fictitious campus outbreaks. Microsoft recommends deploying phishing-resistant MFA to thwart these paycheck plunderers.
Hot Take:
Ahoy, mateys! It seems like the cyber seas are stormy with pirate payroll attacks, and universities are the latest treasure troves. Who knew academia could be so lucrative? If only these hackers put as much effort into legitimate work as they do into these swashbuckling schemes, they might actually make tenure!
Key Points:
- Cybercrime gang Storm-2657 has been targeting U.S. university employees since March 2025.
- Phishing emails are used to hijack salary payments through Workday accounts, with over 6,000 emails sent across 25 universities.
- Attackers exploit the lack of phishing-resistant multifactor authentication to compromise accounts.
- Compromised accounts are used to send more phishing emails and alter salary payment configurations.
- The attacks resemble business email compromise scams, with massive potential financial losses.
Already a member? Log in here