Payroll pirates are conning help desks to steal workers' identities and redirect paychecks

Binary Defense's ARC Labs investigated a payroll diversion attack in which an attacker accessed a shared mailbox, used social engineering to get a help-desk MFA/password reset, authenticated via the organization's VDI to appear as a trusted internal user, and changed Workday direct-deposit details to steal a physician's paycheck; the report warns that identity- and process-based attacks targeting payroll are an emerging high-value threat and recommends stronger controls and fraud-detection for payroll changes.