Payroll Pirates (Storm-2755) hop 1/3: Google Meet/Ads redirector to third-party destination

Duo Tech@duotech

•updated Aug 10, 2026•8•0•4

Detects the Payroll Pirates (Storm-2755) AiTM phishing redirect chain: Google Meet/Ads redirector, an AWS S3 intermediate hop, and final resolution of a previously-unseen domain, indicating completion of the multi-hop chain to an AiTM proxy.