Payroll Pirate: Inbox Rule Suppressing Direct Deposit and HR Keywords

Ethan Andrews@eandrews

•updated Jun 29, 2026•0•0•2

Detects the creation of new Inbox rules in Microsoft 365 that are configured to automatically move or delete emails containing payroll-related keywords such as 'direct deposit', 'bank', or 'hr'. This behavior is consistent with post-compromise activity by threat actors attempting to hide payroll fraud notifications or security alerts from the victim.