Emerging threat: BEC payroll fraud advisory

In July 2022 Expel SOC observed widespread BEC attacks targeting O365/Okta accounts to access Workday payroll systems for direct deposit fraud; attackers commonly used legacy authentication (BAV2ROPC/IMAP/POP3) to bypass MFA, Duo push fatigue, created inbox rules to hide payroll messages, and enrolled trusted devices to maintain access. The report outlines the attack chain, detection alerts (suspicious inbox rules, legacy auth usage, abnormal Okta sessions, Duo push anomalies), and recommended steps for security teams and employees to detect and respond.