Scribd
Upload
75 views

Payroll Diversion Tutorial Updated Version

Uploaded by

ola Yusuf
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
75 views

Payroll Diversion Tutorial Updated Version

Uploaded by

ola Yusuf
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 4

Payroll Diversion Tutorial

(Warning: This tutorial is intended for educational purpose only. Misusing this tool for
malicious or unauthorised purposes is illegal. Such misuse could result in severe financial
losses or legal consequences to victims.)

Tools needed
Apollo
Gophish ($28/m or check group for demo account)
Easydmarc

Apollo is technically free for 13 days , you can keep on creating fresh accounts each time

Create an account on the website and log in . It's preferably best you use Google and then
sign in

After creating your account , Go to people and search . After that click "Email status" and
click "verified" . It should pop out a list of verified users .

Next go to location . What you are trying to do is filter mails . You can either select USA or
Canada depending on which account you would love to receive money and filter in payroll
manager
Now it should bring out a list of payroll managers.

Use easydmarc.com to make sure the email domain is vulnerable

Now select a payroll manager of your choice and add it to your lead sender . In this case I will
be selecting “Luis Guell”
Copy his/her name.
Next step login your Gophish . Click on Users and Groups and start copying. Now we are
going to access her email .
Right click on her name and open a new tab

Click on "access email". Now copy his/her email and first name into a new group in Gophish

Now the payroll manager’s name and email has been successfully added .

Next step is to click on the employees tab to access the company’s employees

Click on it and it should bring a list of employees and their emails. Copy their names, and
their emails.

NOTE:

don’t copy the first 10 names , they are usually top positions, a director can’t be receiving
salary like the rest. (Avoid C-suit roles like CFO,CEO,COO,CTO)

Copy the email in to sender envelop In the email template and the script in to the body and
edit accordingly…

Edit the ‘email header’ in the sending profile by adding a reply-to, which should be the email
Edit the ‘email header’ in the sending profile by adding a reply-to, which should be the email
you’d get replied to

Launch campaign and monitor inbox

Rinse and repeat on as much employees as possible

(Note: You can’t use this method for mass spamming, sending email individually increases
your chances of entering inbox about 67% compared to bulk sending)

Sample script:
Hi John,

I have recently changed my banks, can you update my payroll direct deposit information
since the account on record will be inactive a few days before the next payday

Regards,

Note:
*You will be asked to submit a new account number and routing number information.
*You will be asked to upload a blank check picture with your name and account number on it.
The Payroll officer will then send you employee Direct Deposit forms
to write your name and your new updated Account number and Routing number. Fill it on
Computer

You might also like