Advisory: Phished Sign-Ins Used to Hijack Workday Payroll Sessions
Fluency investigated a compromise at one customer. An attacker captured an employee's password and a one-time MFA code, signed in to Workday through Microsoft single sign-on, and held the Workday session open for about nine hours with an automated script. The session kept working for 83 minutes after the employee's password was reset and their Microsoft sessions were revoked.
The way in resembles the published "payroll pirate" campaigns, in which attackers change an employee's direct-deposit details so the next paycheck goes to an account they control. Here no bank or payment change was made before the session ended, but the attacker did view the employee's tax documents, date of birth, salary and contact details. Any Microsoft Entra ID tenant that signs users in to Workday or another HR or payroll app through SSO is exposed in the same way. Fluency swept every customer tenant and found no other customer affected.
On November 10, 2026, Fluency released a detection to every instance for the step that let this attack through: a user who signs in with a passkey completing a sign-in with a password and a weaker MFA method from a new network. No action is needed to turn it on.