Threat hunters have unveiled a new initiative that employs search engine optimization (SEO) manipulation strategies aimed at employee mobile devices to enable payroll deception. This activity, initially identified by ReliaQuest in May 2025 while focusing on an undisclosed client in the manufacturing industry, is marked by the implementation of counterfeit login pages designed to infiltrate the employee payroll portal and redirect.