Home
/
Blog
/
Featured
/
Risky Business: How HR Tech Can Hurt Identity Security
PUBlished on
March 26, 2024
updated on
November 5, 2025

Risky Business: How HR Tech Can Hurt Identity Security

SHUYANG WANG AND FARAH IYER

In today’s digital-first world, individuals are bringing B2C behaviors into the B2B sphere. Just as someone might casually share personal login details with platforms like Turbotax for tax filing, many are now sharing corporate credentials with third-party providers, for various personal and professional tasks, compromising identity security.

Moreover, a recent investigation by Obsidian’s Threat Research team has shed light on the risks associated with this trend. They detected a critical risk associated with Argyle—a service that facilitates employment and income verification and payroll management by integrating with HR Management (HRM) systems through credential flow.

‍

Why it matters

Argyle’s service presents a significant risk to organizations due to its insecure integration via credential flow. If compromised, this integration provides an uncontrolled pathway for accessing sensitive data, thereby undermining identity security.

HRM system powered by Argyle.

From Obsidian’s investigation thus far, this Argyle risk affects over 800 G2000 companies and numerous others through their HRM systems and Identity Providers (IdPs).

‍

Investigation overview

Obsidian’s Threat Security Research team observed the following suspicious sequence of events across multiple tenants:

  1. An unknown identity is authenticated through an employee’s Identity Provider (IdP) account via anonymous proxy infrastructure with Multi-Factor Authentication (MFA) approval.
  2. Following authentication, the identity employed Single Sign-On (SSO) to gain access to the company’s Human Resource Management (HRM) system, which may have included platforms like Workday and PeopleSoft.
  3. Our telemetry data reveals that within the HRM system, the identity traversed sensitive employment and income information and, in some instances, altered payment elections.

This activity resembles common identity threats, such as gaining initial access through an access broker or carrying out complete payroll theft following an account takeover.

‍

The suspicious identity authenticated through the IdP (via proxy IP) and then employed SSO to access Workday.
The identity was observed modifying payment elections.

‍

The suspicious activity illustrated above was traced back to Argyle. Below, we have outlined how this activity unfolded, starting with the employee entering their corporate credentials into a third-party site, through to Argyle gaining access to both the IdP and HRM service.

‍

‍

Security implications

Although there hasn’t been any observed exploitation, the integration facilitated by Argyle raises various security concerns around identity risks. These include:

‍

Blast radius

A variety of HRM services and IdP solutions are implicated by this risk due to their integration with Argyle.

IdPs:

‍

What should I do to protect my organization?

Unlike the classic identity threat via account takeover, individuals willingly engage in these processes, making self-reporting unlikely. Even strong MFA based on WebAuthN may fall short if weaker methods like SMS or TOTP are allowed to be downgraded. Therefore, continuous monitoring of corporate identity threats becomes paramount to detect and mitigate risks.

‍

Obsidian recommended actions

To enhance security and mitigate risks, we recommend taking the following actions:

1. Deploy Obsidian’s new detection rule:

2. Review audit logs:

3. Identify and take action for exposed accounts:

‍

What identity risks should vendors look out for when implementing 3rd party services?

There’s no denying the value provided by tools that automate traditionally manual processes like employment and income verification. However, as this identity risk scenario highlights, services must undergo careful assessment to safeguard your organization’s security.

OAuth addresses these needs by authorizing access to user-owned resources without exposing credentials to third parties.

Moreover, secure integration should adhere to the principle of least privilege, requesting only essential information for validation (e.g., employment or income status). It should avoid accessing sensitive data such as pay slips or W2 forms. Our examination of HRM systems revealed challenges in meeting these requirements due to the broad access permissions available, sometimes limited to read/write access across all resources.

‍

Appendix (indicators of compromise)

Identified IP addresses:

Most incoming traffic originates from proxy providers. Notable IP addresses observed over the past month include:

User agent strings:

The user agent string linked to the activity may vary over time but frequently repeats:

‍

‍

Frequently Asked Questions (FAQs)

What is the security risk associated with Argyle’s HR Management integration?

Obsidian's Threat Research team identified that Argyle's integration method can expose corporate credentials through a process called credential flow. Employees may unknowingly share their corporate usernames, passwords, and MFA factors with Argyle, which puts sensitive data at risk if Argyle or its integration is compromised. This can potentially lead to unauthorized access to HRM systems and payroll data, amplifying identity security risks for organizations.

How does Argyle's integration compromise corporate identity security?

Argyle prompts employees to enter their corporate credentials directly into its platform, effectively handing over usernames, passwords, and MFA credentials to a third party. Once these credentials are collected, Argyle can obtain valid session tokens, granting persistent access to corporate Identity Providers (IdPs) and HRM systems. This access could be exploited for credential harvesting, session hijacking, and manipulating sensitive data, such as payroll information.

Which Identity Providers and HRM systems are impacted by this risk?

The risk extends to several popular Identity Providers including Okta, Microsoft, Google, Duo, PingID, OneLogin, and more, as well as HRM platforms such as Workday and PeopleSoft. Any organization that integrates HRM systems with these IdPs and allows connection with Argyle’s service should review their identity security measures and audit for suspicious access patterns.

What actions should organizations take to mitigate risks from Argyle integration?

Organizations should deploy Obsidian's “Credential and Cookie Leakage via HRM Credential Flow Integration” detection rule to identify and respond to suspicious activity involving Argyle. Additionally, reviewing audit logs for symptoms of compromise and immediately resetting credentials and sessions for affected accounts are critical steps toward reducing exposure. Continuous monitoring for identity threats and restricting the use of weak MFA methods are also highly recommended.

You May Also Like

Featured

Legacy Security vs. Obsidian: Why SaaS Security Demands a New Approach
4
MIN
November 10, 2025

Featured

How to Choose a SaaS and AI Security Vendor for Enterprise Scale
2
MIN
September 22, 2025

Featured

Salesforce Misconfiguration Continues to Expose Links to the Public
3
MIN
April 29, 2025

Get Started

Start in minutes and secure your critical SaaS applications with continuous monitoring and data-driven insights.

get a demo