Payroll Pirate Campaign Uses AiTM Session Hijacking to Bypass MFA and Redirect Salaries

Gbhackers •Mayura Kathir • June 15, 2026

A financially motivated campaign dubbed “Payroll Pirate” has emerged using advanced phishing and adversary-in-the-middle (AiTM) session hijacking to bypass multifactor authentication (MFA) and reroute payroll disbursements. This operation targets payroll and HR portals at mid-market and enterprise organizations, chaining credential theft, real-time session interception, and subtle profile changes to siphon funds without triggering conventional alarms. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Payroll Pirate Campaign Targets Payroll Systems Using AiTM Session Hijacking The 'Payroll Pirate' campaign has emerged, utilizing advanced phishing and AiTM session hijacking to bypass MFA and reroute payroll disbursements. Targeting mid-market and enterprise organizations, attackers exploit payroll and HR portals, chaining credential theft and real-time session interception. The attack begins with phishing payroll administrators, capturing MFA tokens through an AiTM proxy to hijack sessions. Once inside, attackers modify payment instructions and create fraudulent vendor accounts while evading detection. The campaign employs sophisticated social engineering techniques, including deepfake-style communications. Funds are laundered through mule accounts and cryptocurrency exchanges, complicating recovery efforts. Recent observations indicate that this method can bypass many MFA implementations, necessitating enhanced security measures. Organizations are advised to implement step-up authentication for high-risk actions and monitor for behavioral anomalies. 2 sources 69

Extracted Entities

Payroll Pirate Campaign Uses AiTM Session Hijacking to Bypass MFA and Redirect Salaries

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

MITRE ATT&CK (1)