Hackers Pose as Organizations to Hijack Payroll Logins and Divert Payments from Employees

A sophisticated cyberattack campaign leveraging search engine optimization (SEO) poisoning techniques has been uncovered, enabling threat actors to divert employee payroll payments by hijacking authentication credentials.

ReliaQuest identified this novel attack chain that specifically targets the payroll processes of enterprises, with a recent case impacting a manufacturing sector client and exposing significant security gaps in how organizations manage off-network device authentication.

Technical Overview

In this campaign, adversaries deploy highly engineered fake login portals that mimic legitimate organizational web pages.

By manipulating mobile-device-specific ad settings, these malicious websites appear at the top of search results when employees search for payroll or HR portal access on their phones.

Employees accessing these sites often outside corporate networks and security controls unknowingly input their credentials into phishing pages.

When credentials are entered, the phishing page sends an HTTP POST request to an attacker-controlled PHP endpoint.

Simultaneously, a WebSocket connection is established with ws-ap2.pusher[.]com using the attacker’s Pusher application key, offering the threat actor real-time notification of compromised accounts.

This innovative abuse of the legitimate Pusher messaging platform allows attackers to promptly harvest credentials and rapidly use them to access payroll systems before defensive actions can be taken.

Proxy Network Evasion

The campaign’s focus on mobile devices poses a unique challenge for security teams.

Mobile endpoints, frequently disconnected from secure Wi-Fi or corporate networks and lacking enterprise-grade monitoring, become a blind spot for detection tools.

Furthermore, because these attacks often occur outside standard working hours and networks, incident response and forensics are significantly hindered.

After harvesting credentials, the attacker logs into the organization’s payroll portal, often SAP SuccessFactors, from a series of obfuscated residential IP addresses.

Analysis revealed that many of these IPs originate from consumer routers such as ASUS and Pakedge compromised via default credentials or unpatched vulnerabilities (e.g., CVE-2024-3080, CVE-2025-2492).

These infected routers are then utilized as proxies, making attacker traffic indistinguishable from legitimate user activity and undermining IP-based geolocation or blacklisting defenses.

Upon successful access, the adversary alters direct deposit settings in payroll systems, funneling wages to attacker-controlled accounts.

The use of residential proxies and dynamic IPs acquired from commercial proxy botnet services allows sustained access and camouflages malicious behavior, complicating forensic investigations and response.

The financial impact is substantial, with risks including direct monetary loss, erosion of employee trust, payroll disruptions, and regulatory penalties for mishandling personal and financial data.

To mitigate the risk from such advanced campaigns, security teams are urged to enforce multifactor authentication (MFA) for payroll systems, establish out-of-band alerts for direct deposit changes, and invest in digital risk protection services to rapidly detect domain impersonation.

Employee awareness campaigns and strict guidance to access payroll portals via bookmarked URLs or SSO should complement technical controls.

Additionally, advanced monitoring should be implemented for anomalous access patterns, especially those emanating from suspicious residential networks.

This campaign marks a dangerous evolution in payroll fraud, combining social engineering, real-time credential theft, and proxy-based evasion.

Organizations must reassess their off-network security posture, especially regarding mobile device access to sensitive portals, and align policies to counter these emerging TTPs.

A zero-trust approach, robust user education, and rapid threat intelligence ingestion are essential to prevent similar incidents.

Indicators of Compromise (IOC)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates