Payroll Pirate: Passkey Downgrade Phishing and Payroll Session Hijack
| Attack type | Phishing, session theft: adversary-in-the-middle with an MFA downgrade |
| Threat actors | Unattributed. The way in matches the "payroll pirate" campaigns Microsoft has reported, and any adversary-in-the-middle phishing kit can do it |
| Coverage since | November 10, 2026 |
| Platforms | Microsoft Entra ID, with single sign-on to Workday and other HR and payroll apps |
A passkey only protects the sign-ins that use it. A passkey cannot be phished: the browser binds it to the real sign-in site. So the phishing page does not try. It leads the user to "use another method", relays the password and one-time code they type, and keeps the session. Microsoft sees a completed MFA. The attacker opens the payroll app through single sign-on, where a changed bank account sends the next paycheck somewhere else.
The threat
- The passkey is sidestepped, not broken. If a user can also sign in with a one-time code, a push or a text message, an adversary-in-the-middle page can steer them to it. Some kits send a browser identity that Entra ID offers no passkey to, so the weaker method is the only one on the page.
- Straight to payroll. The attacker can use the session for one thing: the HR or payroll app behind Microsoft single sign-on. When no email, files or other apps are touched, mailbox detections have nothing to see.
- Seconds, not hours. Tax documents, date of birth, salary and contact details can be open within seconds of the sign-in, and the task that changes personal and payment details is one click away.
- A session that does not time out. A script that repeats a small action every few minutes keeps the payroll app from ending the session.
- It outlives the password reset. The payroll app keeps its own session. Resetting the password and revoking the user's Microsoft sessions does not end it.
Why it gets past defenses
- The passkey was available, not required. Unless Conditional Access demands a phishing-resistant method, any weaker method the user has registered still opens the same apps.
- "MFA satisfied" hides the risk. Entra ID can rate the sign-in high risk and still allow it, because a relayed code completes MFA, and a completed MFA marks the risk as remediated.
- One ordinary-looking sign-in. There is no burst of failures, no impossible travel across many addresses and no mailbox activity: one successful sign-in to one app.
- Containment stops at Microsoft. Workday, Salesforce and other SSO apps keep their own sessions until those expire or are ended inside the app.
How Fluency catches it
Fluency compares how the user just signed in with how that user signs in.
- The downgrade. Fluency learns which networks each user's passkey, security-key and certificate sign-ins come from. A password and a weaker method soon after a passkey sign-in, from a network the passkey has never been used from, on a device that is not the user's compliant one, raises a high alert. A sign-in from a network the user's passkey is used from, or on their compliant device, does not.
- The disguise. A password and a weaker method from a browser that claims to be Safari on Windows raises the same alert with no history needed. Apple no longer ships that browser; phishing kits send it to hide the passkey option.
- No trust in "MFA satisfied". The detection reads the methods the sign-in used, not Microsoft's risk rating, so a remediated risk does not hide it, and it needs no Entra ID P2.
- The relay and the replay. The detections for adversary-in-the-middle session theft still apply: the proxied sign-in itself, and the stolen session turning up from a network the user never had.
- What happened inside payroll. Fluency collects the Workday user activity log: which account ran which task, from which address and session. It shows what the attacker opened, and whether the session is still running after the password reset.
From the field
In an intrusion Fluency investigated, an employee who normally signed in with a passkey was led to "use another method". The attacker signed in from a hosting provider in Virginia on a device Microsoft had never seen, and within 5 seconds had the employee's tax documents, date of birth, salary and contact details open in Workday. A script then repeated a personal-information edit about every 3 minutes for about nine hours. The Workday session kept running for 83 minutes after the password was reset and the Microsoft sessions were revoked. No bank or payment change was made before it ended.
The full account, with indicators and the steps to take in Entra ID and in Workday, is in the advisory.
Detections included
| Detection | What it catches |
|---|---|
| Passkey downgrade | A passkey, security-key or certificate user signing in with a password and a weaker MFA method from a network they have never used the stronger method from, or from a browser claiming to be Safari on Windows: the step a phishing page needs to get past a passkey. |
| Proxied sign-in | The proxied sign-in in Entra ID sign-in logs: the moment the session is captured. |
| Session replay | A captured session used from a network the user did not have, whether minutes or weeks after the capture. |
| High-risk sign-in | A sign-in that passed authentication and that Entra ID Protection rates high risk: Microsoft's own warning, next to everything else Fluency knows about the user. |
New or changed MFA methods (how an attacker plants a second factor of their own) go on the user's timeline, so they are in front of the analyst for every one of these alerts.
MITRE ATT&CK
| Tactic | Technique |
|---|---|
| Credential Access | T1557 Adversary-in-the-Middle, T1111 Multi-Factor Authentication Interception, T1539 Steal Web Session Cookie |
| Defense Evasion, Lateral Movement | T1550.004 Use Alternate Authentication Material: Web Session Cookie |
| Initial Access, Persistence | T1078.004 Valid Accounts: Cloud Accounts |
Get this coverage
The detections are on every Fluency instance and need the Entra ID sign-in logs, collected through Azure Event Hubs or Microsoft Graph. The downgrade detection needs no Entra ID P2; on a newly connected instance it first learns each user's networks before the passkey comparison alerts, while the Safari-on-Windows check alerts from the start. Connect Workday to have the payroll side of an investigation on hand: Workday keeps its user activity log for a limited time.
Detection shortens the attacker's window; a phishing-resistant sign-in closes it. Pair the detections with prevention:
- Require the Phishing-resistant MFA authentication strength in Conditional Access for Workday and every payroll or banking-detail app.
- Block high-risk sign-ins, or require a phishing-resistant method for them, instead of accepting any MFA.
- Restrict one-time codes, text messages and phone calls for users who have a passkey, starting with HR, payroll, finance and administrators.
- When an account is compromised, end its sessions inside every SSO application, not only in Entra ID.
Not a customer yet? Start a free trial or book a demo.
Related
- Storm-2755: AiTM session theft: the same phishing technique against users without a passkey, followed into the mailbox.
- Advisory: Phished Sign-Ins Used to Hijack Workday Payroll Sessions: what Fluency observed, the indicators, and what to change in Entra ID and Workday.
- Passkey Downgrade Detection: the release notes, with the rule's full match conditions, what it does not cover, and triage guidance.