Storm-2755 AiTM Phishing and Payroll Fraud Campaign

Arctic Wolf Labs and Microsoft are tracking an ongoing financially motivated campaign attributed to Storm-2755 (also known as Payroll Pirates). The actor utilizes sophisticated Adversary-in-the-Middle (AiTM) techniques to bypass multi-factor authentication (MFA) and compromise Microsoft 365 accounts. The campaign primarily targets users in Canada, the United States, and Europe across sectors including healthcare, education, manufacturing, and government.

The attack chain involves voicemail-themed phishing lures or SEO poisoning that directs victims to fraudulent authentication proxies hosted on infrastructure like OpenResty and AWS S3. Once access is gained, the actor employs automated tooling to maintain sessions at eight-hour intervals via residential proxy networks (such as anyIP) to blend with legitimate consumer traffic. The ultimate objective is the discovery of financial workflows to facilitate payroll diversion, often involving direct manipulation of SaaS platforms like Workday.

This campaign is highly effective because it avoids traditional 'noisy' BEC behaviors like lateral phishing or inbox rule mass-creation initially, focusing instead on quiet persistence and targeted mailbox collection. Organizations are urged to prioritize phishing-resistant MFA and monitor for specific anomalous non-interactive sign-in patterns to detect these durable session-hijacking attempts.