Employees Searching Payroll Portals on Google Tricked Into Sending Paychecks to Hackers

May 27, 2025
Ravie Lakshmanan

Threat hunters have exposed a novel campaign that makes use of search engine optimization (SEO) poisoning techniques to target employee mobile devices and facilitate payroll fraud.

The activity, first detected by ReliaQuest in May 2025 targeting an unnamed customer in the manufacturing sector, is characterized by the use of fake login pages to access the employee payroll portal and redirect paychecks into accounts under the threat actor's control.

"The attacker's infrastructure used compromised home office routers and mobile networks to mask their traffic, dodging detection and slipping past traditional security measures," the cybersecurity company said in an analysis published last week.

"The adversary specifically targeted employee mobile devices with a fake website impersonating the organization's login page. Armed with stolen credentials, the adversary gained access to the organization's payroll portal, changed direct deposit information, and redirected employees' paychecks into their own accounts."
https://thehackernews.com/2025/05/employees-searching-payroll-portals-on.html?_m=3n%2e009a%2e3678%2eqb0ao44uux%2e2pho