Payroll, HR Teams Targeted In New Business Email Compromise Campaign

Researchers warn that attackers are impersonating payroll and HR employees in an effort to hijack Microsoft 365 accounts and gain access to sensitive employee and financial data.

A newly identified business email compromise (BEC) campaign is targeting payroll and human resources personnel through Microsoft 365, underscoring the pervasiveness of identity-based attacks.

Researchers at cybersecurity firm Arctic Wolf recently reported what they called a "Payroll Pirates" campaign, where threat actors spoof legitimate payroll communications and direct victims to fraudulent Microsoft 365 login pages set up to capture credentials.

For midsize organizations, the new threat highlights again that attackers are increasingly aiming for identities rather than endpoints, seeking access to internal systems through trusted users.

A High-Value Target

The fact that payroll and HR teams make attractive targets comes as no surprise. They routinely handle sensitive data, compensation information and account changes. One compromised account within these departments can provide an adversary with access to financial information, internal communications and perhaps even more broadly across organizational systems.

Security Remains A Top Priority For Midmarket IT Leaders

Concerns over new threats align with what midmarket IT leaders are prioritizing in their operations. An analysis of the 2026 MES Midmarket 100 reveals that security remains the largest category represented on the annual list, reflecting continued customer demand for technologies that address identity, access, and cyber risk challenges.

That focus is further evidenced by MES Computing's broader coverage on emerging risks. As midmarket organizations evaluate and deploy AI agents, automation, and increasingly converged and interconnected systems, experts have repeatedly warned that excessive permissions and lax governance can create new attack opportunities.

Takeaways For Midmarket IT Leaders

Arctic Wolf's findings highlight several areas for IT security leaders to revisit:

Authentication controls for payroll and HR employees

Conditional access policies for Microsoft 365 accounts

Monitoring anomalous login activity

Employee phishing awareness training

Privileged access account reviews

Ransomware may garner the most dramatic headlines, but BEC remains one of the most financially harmful forms of cybercrime. Attacks that compromise HR and payroll can lead to fraud, data exposure, operational disruption and reputational risk, making identity protection a critical cybersecurity strategy component.