Payroll Pirate Campaign Uses AiTM Session Hijacking to Bypass MFA and Redirect Salaries

This report outlines the "Payroll Pirate" campaign in which attackers target payroll and HR administrators using tailored reconnaissance, phishing on lookalike domains, and AiTM proxies to capture MFA tokens and hijack live sessions to modify payees and siphon funds; operators favor small transfers, timing near payroll windows, and log/notification tampering to evade detection. The report enumerates technical indicators (unexpected 302 redirects, mismatched TLS, intermediary domains), emphasizes phishing-resistant and origin-bound authentication (WebAuthn/hardware keys), step-up verification and dual-approval for payment changes, and recommends behavioral and transactional monitoring to detect such attacks.