Payroll Pirate - AiTM Phishing Domain Network Connection

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•5

Detects network connections from common browser processes and script execution engines to the known Payroll Pirate (Storm-2755 / Storm-2657) phishing domain 'bluegraintours.com', which is associated with Adversary-in-the-Middle (AiTM) session cookie and OAuth token harvesting.