Microsoft: Hackers target universities in “payroll pirate” attacks

Microsoft observed a coordinated 'payroll pirate' campaign by Storm-2657 that used tailored phishing (including AITM links) to bypass MFA, compromise Exchange Online accounts at several U.S. universities, set mailbox rules to hide notifications, access Workday via SSO, and alter payroll to redirect salary payments; 11 accounts at three universities were confirmed compromised and phishing messages were sent to nearly 6,000 addresses across 25 universities.