Storm-2755 Payroll Pirates AitM Phishing Campaign

Arctic Wolf Labs is tracking a widespread, active campaign attributed to Storm-2755 (Payroll Pirates) targeting healthcare, education, manufacturing, government, and professional services across North America and Europe. The actor utilizes voicemail-themed phishing lures and sophisticated adversary-in-the-middle (AiTM) techniques to bypass Multi-Factor Authentication (MFA) and obtain session tokens for Microsoft 365 accounts.

Technically, the campaign is notable for its use of multi-stage redirect chains—abusing legitimate services like Google Meet and AWS S3—and its reliance on rotating residential proxies to mask malicious activity as legitimate consumer traffic. Once access is established, the threat actor uses automated tooling to maintain sessions at eight-hour intervals and leverages Microsoft Graph API for reconnaissance to identify personnel involved in financial workflows.

This activity represents a significant business risk, as the primary objective is the targeted collection of payroll, invoice, and banking-related emails. By avoiding traditional high-noise Business Email Compromise (BEC) behaviors, such as immediate lateral phishing or inbox rule changes, the actor maintains a low profile, making traditional detection difficult without focused identity and session correlation.