An attacker created fake desktop app pages for three major US payroll and HR platforms that do not offer desktop apps, then used them to install ScreenConnect for hidden remote access. The campaign used AI-generated lure pages, GitHub-hosted installers, and a single command-and-control server to potentially divert or drain payroll accounts. #ScreenConnect #Lovable #Vercel #GitHub

Attackers are using social engineering to trick help desks and payroll fraud to steal employee salaries by targeting HR systems like Workday.

Storm-2755, a financially motivated group, has been hijacking Canadian employees' payroll accounts to steal salary payments in payroll‑pirate attacks. They deploy malicious Microsoft 365 sign‑in pages and AiTM frameworks to capture session cookies and OAuth tokens—bypassing legacy MFA—to access accounts, hide HR messages, and change direct deposit details (including via Workday). #Storm-2755 #Microsoft365