Payroll Pirate Internal Spearphishing to HR/Payroll via Compromised M365 Account

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•3

Detects internal emails with subject or body content related to payroll information changes (e.g., direct deposit, bank account redirection) sent to HR or payroll-related email addresses or recipients. This behavior is indicative of internal Business Email Compromise (BEC) or an attempt by an attacker (or compromised insider) to facilitate payroll fraud.