Cybersecurity threats are rapidly evolving, and financially motivated actors are becoming increasingly sophisticated in their methods. A recent campaign identified by Microsoft highlights this shift. The threat actor, tracked as Storm-2755, has been executing targeted “payroll pirate” attacks, primarily affecting users in Canada.
Understanding the Threat Landscape
Storm-2755’s campaign represents a new wave of cyberattacks focused on direct financial gain rather than data theft alone. The attackers compromise user accounts and manipulate payroll systems to redirect salaries into attacker-controlled bank accounts. This results in immediate financial losses for both employees and organizations.
What sets this campaign apart is its broad, geography-based targeting strategy. Instead of focusing on a specific sector, the attackers leveraged SEO poisoning and malvertising, tricking users into visiting fake login pages that mimic Microsoft 365 portals.
Attack Chain Breakdown
1. Initial Access via Deception
The attack begins with users searching for common terms like “Office 365.” Malicious links appear at the top of search results, leading victims to counterfeit login pages. Once credentials are entered, attackers capture not only usernames and passwords but also session tokens.
This technique is known as an Adversary-in-the-Middle (AiTM) attack, which allows attackers to intercept authentication sessions in real time. Unlike traditional phishing, AiTM enables bypassing of standard multi-factor authentication (MFA).
2. Session Hijacking and Persistence
Storm-2755 uses stolen session tokens to maintain persistent access. These tokens allow attackers to impersonate users without triggering additional authentication checks. Automated requests—often every 30 minutes—help sustain access while blending into normal user activity.
The attackers also exploit tools like Axios (an HTTP client), potentially leveraging vulnerabilities such as CVE-2025-27152 to maintain communication with compromised systems.
3. Discovery and Target Identification
Once inside, attackers search internal systems for payroll and HR-related data. Keywords like “payroll,” “finance,” and “HR” are commonly used to locate sensitive workflows.
They then initiate social engineering attacks, typically sending emails with subject lines like “Question about direct deposit” to HR departments, requesting changes to banking details.
4. Defense Evasion Techniques
To remain undetected, attackers create email inbox rules that automatically hide responses from HR. Emails containing keywords like “bank” or “direct deposit” are moved to hidden folders, preventing the victim from noticing suspicious activity.
Additionally, attackers operate during off-hours (e.g., early morning) to avoid detection and reduce the chance of session interruption.
5. Financial Impact
In confirmed cases, attackers successfully modified payroll details, redirecting salary payments to fraudulent accounts. In some scenarios, they directly accessed HR platforms like Workday to manually change banking information.
| Tactic | Observed activity | Observed Behavior |
| Credential access | An OAuth device code authentication was detected in an unusual context based on user behavior and sign-in patterns. | – Anomalous OAuth device code authentication activity |
| Credential access | A possible token theft has been detected. Threat actor tricked a user into granting consent or sharing an authorization code through social engineering or AiTM techniques. | – Possible adversary-in-the-middle (AiTM) attack detected (ConsentFix) |
| Initial access | Token replay often result in sign ins from geographically distant IP addresses. The presence of sign ins from non-standard locations should be investigated further to validate suspected token replay. | – Atypical Travel – Impossible Travel – Unfamiliar sign-in properties (lower confidence) |
| Initial access | An authentication attempt was detected that aligns with patterns commonly associated with credential abuse or identity attacks. | – Potential Credential Abuse in Entra ID Authentication |
| Initial access | A successful sign in using an uncommon user-agent and a potentially malicious IP address was detected in Microsoft Entra. | – Suspicious Sign-In from Unusual User Agent and IP Address |
| Persistence | A user was suspiciously registered or joined into a new device. | – Suspicious Entra device join or registration |
Defensive Strategies and Mitigation
Organizations must adopt a multi-layered security approach to defend against such attacks:
- Phishing-resistant MFA (e.g., FIDO2/WebAuthN)
- Conditional Access Policies to limit session lifetimes
- Continuous Access Evaluation (CAE) for real-time token revocation
- Monitoring for unusual user agents like Axios
- Detection of suspicious inbox rules
- Use of SIEM and endpoint protection tools like Microsoft Defender
Immediate response actions should include revoking tokens, resetting credentials, and auditing user sessions.
Our Perspective on the Storm-2755 Campaign
The Storm-2755 campaign underscores a critical shift in cybercrime: attackers are no longer just stealing data—they are monetizing access instantly. This evolution makes such attacks more dangerous because the impact is immediate and measurable.
What stands out most is the effectiveness of simplicity. Instead of deploying highly complex malware, the attackers rely on social engineering, session hijacking, and legitimate workflows. This makes detection significantly harder, as malicious activity closely resembles normal user behavior.
Another concerning aspect is the weakness of traditional MFA systems. Many organizations still rely on SMS or push-based authentication, which are no longer sufficient against AiTM attacks. This campaign clearly demonstrates that identity security must evolve beyond legacy MFA.
From a strategic standpoint, organizations must prioritize Zero Trust architectures. Trust should never be assumed based on authentication alone—continuous verification is essential.
Finally, user awareness remains a crucial defense layer. Even the most advanced security systems can fail if users unknowingly hand over credentials. Regular phishing simulations and training programs are not optional—they are essential.
In conclusion, Storm-2755 is not just another cyberattack—it is a blueprint for future financially driven threats. Organizations that fail to adapt their security posture risk facing similar, if not more severe, consequences.
