Anatomy of an Attack: The Payroll Pirates and the Power of Social Engineering
Summary: An attacker impersonated employees to manipulate payroll, IT and HR help desks, circumventing challenge/response authentication to reset passwords and re-enroll MFA devices, then modified direct-deposit details to redirect paychecks into attacker-controlled accounts. Unit 42's 2025 Global Incident Response Report: Social Engineering Edition found that 36% of incidents it engaged with began with a social engineering tactic, and this incident was discovered only when employees reported missing paychecks, with suspicious account changes dating back weeks.
Bottom line: The compromise was contained to three employee accounts largely because the organization acted quickly and the attacker sought financial gain rather than deeper access - but the same threat hunting that confirmed the payroll diversion also found a long-standing WannaCry compromise in the client's legacy OT environment.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026