‘Looting US university salaries’: Microsoft warns of ‘payroll pirate’ scam

Microsoft’s Threat Intelligence team has sounded the alarm, reason is: A notorious cybercrime group, tracked as Storm-2657 by Microsoft’s team, has launched a brazen attack on US university payroll systems since March 2025. In a blog post, Redmond said a cybercrime crew it tracks as Storm-2657 has been targeting university employees since March 2025, hijacking salaries by breaking into HR software such as Workday.

Dubbed “payroll pirate” by Microsoft’s Threat Intelligence team, the campaign exploits weak security practices to redirect paychecks into attacker-controlled bank accounts.