Attackers Redirected Employee Paychecks Without Breaching a Single System

A financially motivated attack used persistent social engineering against help-desk, payroll, IT, and HR teams to reset credentials, re-enroll MFA, and register an external authentication email in Azure AD, allowing the attacker to modify employees' direct-deposit details and divert paychecks to attacker-controlled accounts; the scheme involved no malware or network breach and was detected after several employees reported missing salary deposits.