# Storm-2755 'Payroll Pirate' Campaign: AiTM Phishing and Workday Account Hijacking Targeting Canadian Employees (CVE-2025-27152)

> Microsoft Threat Intelligence is tracking Storm-2755, a financially motivated actor conducting 'payroll pirate' attacks against Canadian employees. The group uses SEO poisoning and malvertising to lure victims to an adversary-in-the-middle (AiTM) phishing site at bluegraintours[.]com, captures Microsoft 365 session tokens via a malicious Axios 1.7.9 client (CVE-2025-27152), creates inbox rules to hide HR correspondence, then hijacks Workday sessions to rewrite direct deposit banking details and redirect salary payments to attacker-controlled bank accounts.

- **Published:** 2026-04-10T12:00:00Z
- **Last reviewed:** 2026-04-10T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0346
- **ID:** TL-2026-0346
- **Severity:** HIGH (CVSS 7.5)
- **Category:** PHISHING
- **Status:** MONITORING
- **Actor:** Storm-2755
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-27152

## Description

Storm-2755 is a financially motivated threat cluster identified by the Microsoft Incident Response (DART) and Microsoft Threat Intelligence teams as the operator behind an active 'payroll pirate' campaign targeting Canadian employees throughout early 2026. The group combines initial credential and token theft with session persistence and targeted HR/payroll reconnaissance to redirect victims' salary payments into attacker-controlled bank accounts, netting direct financial losses for compromised workers and their employers. The campaign follows the operational playbook previously documented in Microsoft's October 2025 reporting on Storm-2657, which targeted U.S. university employees with the same payroll redirection TTP, but Storm-2755 represents a distinct cluster focused geographically on Canadian organizations.

Initial access is achieved through SEO poisoning and malvertising on industry-agnostic search terms such as 'Office 365' and common misspellings like 'Office 265'. The actor-controlled domain bluegraintours[.]com is positioned at the top of search results and serves a high-fidelity clone of the Microsoft 365 sign-in experience. Victims who enter credentials on the page interact with an adversary-in-the-middle (AiTM) framework that transparently proxies the authentication flow to Microsoft Entra ID, harvesting primary credentials alongside post-MFA session cookies and OAuth access tokens. Microsoft observed Entra sign-in logs consistently returning error code 50199 (sign-in interrupt) immediately prior to successful token issuance, a signature indicator of Storm-2755's AiTM phishing kit.

Once a session token is captured, Storm-2755 replays it using a malicious Axios 1.7.9 HTTP client. Axios 1.7.x is affected by CVE-2025-27152, a server-side request forgery / absolute URL handling flaw that the actor weaponizes to proxy Entra authentication flows and relay tokens without re-authentication. Because legacy multi-factor authentication is satisfied at the time the session is minted, the stolen cookie lets the attacker fully bypass MFA from attacker-owned infrastructure. Microsoft observed the session ID remaining unchanged across geographically distant IP address changes, a reliable compromise signal. Non-interactive sign-ins to the OfficeHome application are issued by the attacker approximately every 30 minutes to keep tokens warm, and token renewal activity was concentrated around 05:00 local victim time to evade business-hours anomaly detection.

In the discovery phase, Storm-2755 performs intranet and mailbox searches for keywords including 'payroll', 'HR', 'human', 'resources', 'support', 'info', 'finance', 'account', and 'admin' to map the victim's HR and payroll workflow. To suppress victim awareness of the impending fraud, the actor creates Outlook inbox rules (New-InboxRule) that automatically move any incoming message containing the strings 'direct deposit' or 'bank' to the Conversation History folder or delete them outright, and sets StopProcessingRules so the forged email chains never surface in the Inbox. Storm-2755 then sends spoofed messages with the subject line 'Question about direct deposit' to HR personnel on behalf of the victim, laying groundwork for the banking change.

The impact stage is executed hands-on-keyboard against the victim's Workday tenant. Using the hijacked Microsoft 365 SSO session, the attacker authenticates to Workday and navigates to 'Change My Account' and 'Manage Payment Elections', substituting attacker-controlled bank account and routing numbers on the direct deposit configuration. Because the rogue mailbox rules suppress every confirmation email from Workday and the HR team, the victim receives no notification until the first pay cycle fails to deposit. Although Microsoft's published case work centers on Workday, the same token replay and social-engineering workflow translates cleanly to ADP, UKG Pro, Ceridian Dayforce, and any SaaS payroll platform that accepts Entra ID SSO tokens.

Microsoft's defensive guidance centers on phishing-resistant MFA (FIDO2 / Windows Hello for Business), Continuous Access Evaluation (CAE), Conditional Access policies that bind sessions to compliant Intune-managed devices, blocking legacy authentication, and alerting on New-InboxRule / Set-InboxRule activity that filters on payroll keywords. Payroll and HR teams should immediately implement out-of-band verification of all direct deposit change requests and audit the last 90 days of Workday 'Manage Payment Elections' events for anomalies. Defenders should hunt for Axios/1.7.9 user-agent strings in Entra sign-in logs, Entra error code 50199 patterns, and any inbound connection to bluegraintours[.]com at the DNS and web proxy layer.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608.006 SEO Poisoning
- T1650 Acquire Access
- T1566.002 Spearphishing Link
- T1189 Drive-by Compromise
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1187 Forced Authentication
- T1598.003 Spearphishing Link
- T1550.001 Application Access Token
- T1550.004 Web Session Cookie
- T1564.008 Email Hiding Rules
- T1137.005 Outlook Rules
- T1078.004 Cloud Accounts
- T1098 Account Manipulation
- T1098.002 Additional Email Delegate Permissions
- T1087 Account Discovery
- T1114 Email Collection
- T1114.002 Remote Email Collection
- T1102 Web Service
- T1071.001 Web Protocols
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft
- T1565.001 Stored Data Manipulation

## Sources

- [Investigating Storm-2755: 'Payroll pirate' attacks targeting Canadian employees](https://www.microsoft.com/en-us/security/blog/2026/04/09/investigating-storm-2755-payroll-pirate-attacks-targeting-canadian-employees/)
- [Microsoft: Canadian employees targeted in payroll pirate attacks](https://www.bleepingcomputer.com/news/microsoft/microsoft-canadian-employees-targeted-in-payroll-pirate-attacks/)
- [Investigating Storm-2755: Payroll pirate attacks targeting Canadian employees (mirror)](https://thewindowsupdate.com/2026/04/09/investigating-storm-2755-payroll-pirate-attacks-targeting-canadian-employees/)
- [Investigating targeted payroll pirate attacks affecting US universities (Storm-2657 prior campaign)](https://www.microsoft.com/en-us/security/blog/2025/10/09/investigating-targeted-payroll-pirate-attacks-affecting-us-universities/)
- [Storm-2755 Payroll Attacks: How AiTM Session Hijacking Redirects Canadian Wages](https://windowsnews.ai/article/storm-2755-payroll-attacks-how-aitm-session-hijacking-redirects-canadian-wages.411188)
- [Malware.news: Investigating Storm-2755 discussion thread](https://malware.news/t/investigating-storm-2755-payroll-pirate-attacks-targeting-canadian-employees/105906)
- [Microsoft Threat Intelligence on Storm-2657 (X/Twitter)](https://x.com/MsftSecIntel/status/1976302649461834229)
- [CVE-2025-27152 - Axios SSRF / absolute URL handling](https://nvd.nist.gov/vuln/detail/CVE-2025-27152)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0346