Arctic Wolf researchers are tracking a widespread, active Microsoft 365 account-compromise campaign that shares significant tactical overlap with the "Payroll Pirates" activity cluster Microsoft tracks as Storm-2755, first documented publicly by Microsoft's Security Blog on 2026-04-09 against Canadian organizations and now observed more broadly across the U.S., Canada, and Europe.

Victims receive voicemail-themed phishing emails styled as automated call notifications with Microsoft branding and an "OPEN [Organization] VOICEMAIL PORTAL" call to action, with subject lines following the pattern '[Organization] :ATTN: Review messages. Ref id: [random string]'. Clicking the link routes the victim through a multi-stage redirect chain built entirely from abused legitimate infrastructure: a Google Meet link-redirect URL, Google's outbound-link infrastructure, a Google Ads Campaign Manager /ddm/clk dynamic click tracker, and an Amazon S3-hosted landing page, before finally reaching an attacker-registered adversary-in-the-middle (AiTM) domain. Separately, Microsoft's Storm-2755 reporting describes SEO poisoning and malvertising that ranked the actor-controlled domain bluegraintours[.]com at the top of search results for queries like "Office 365" and common misspellings such as "Office 265", driving victims directly to a spoofed Microsoft 365 sign-in page.

The AiTM infrastructure is newly registered (domains observed less than 10 days old at time of use) and hosted on Hostinger, serving over HTTP/2 with response headers 'server: openresty/1.31.1.1' and 'x-powered-by: Express' at the root, and 'x-powered-by: PHP/8.2.32' on a fingerprinting endpoint at path '/st_58200519/class_identifier.php'. That endpoint collects a browser/device fingerprint (navigator properties, screen dimensions, language, timezone, WebGL vendor/renderer, cookie support) and queries api.country.is for geolocation, storing the result in a 7-day 'rcfh_country' cookie, before serving a reverse-proxied copy of the genuine Microsoft authentication flow. Because the kit proxies the real Microsoft login in real time rather than presenting a static credential-harvesting page, it captures session cookies and OAuth access/refresh tokens as the victim completes an otherwise normal sign-in, including MFA — rendering non-phishing-resistant MFA insufficient. A missing OAuth nonce parameter in the AiTM-initiated flow produces the rare Microsoft Entra sign-in error 90014, and Entra error 50199 has been observed immediately preceding successful token replay; both are high-fidelity indicators when paired with residential-proxy source traffic. Microsoft's Storm-2755 reporting separately documents an Axios/1.7.9 HTTP client used to replay stolen tokens roughly every 30 minutes, keeping sessions alive for up to approximately 30 days until refresh-token expiration.

Post-compromise sign-in activity shows a distinctive pattern: an initial burst of sign-ins from multiple residential-proxy IP addresses within seconds of compromise, often reporting implausible OS/browser combinations (e.g., Mobile Safari reported on Windows 10); recurring "maintenance" sign-ins roughly every 8 hours (11-24 hours after the initial burst) from rotating residential-proxy addresses commonly associated with an "anyIP"-style network; and a single Entra SessionID persisting unchanged across many different source IP addresses, ASNs, and geographic locations. The client consistently claims to be Microsoft Outlook while the actual user-agent string is anomalous — Firefox 131.0, Firefox 151.0, or Python Requests — rather than a genuine Outlook/Edge client.

Once inside a tenant, the actor queries Microsoft Graph (GET https://graph.microsoft.com/v1.0/users with role/department filters for payroll, HR, finance, and administrative terms; GET https://graph.microsoft.com/v1.0/users?$top=999 for broad enumeration; and GET https://graph.microsoft.com/v1.0/me) using the user-agent 'axios/1.18.1', triggering the Microsoft Defender XDR alert "Suspicious Exchange Online Graph Reconnaissance Activity." The actor then reads mailbox content via MailItemsAccessed "Bind" operations (ClientAppId 5d661950-3475-41cd-a2c3-d671a3162bc1 claiming Microsoft Outlook, undocumented APIId c999ed3e-27ae-4cb3-b3a2-46b056af63d3, user-agent 'Client=REST;Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0'), searching for messages containing payroll, invoices, payments, banking, benefits, and internal-documentation keywords. This collection is tightly synchronized across tenants — Arctic Wolf observed 18 MailItemsAccessed events across 3 different tenants within 26 seconds, and 11 events across 2 tenants within 43 seconds — indicating centralized, automated orchestration rather than manual, per-victim browsing.

Most intrusions deliberately avoid classic business-email-compromise indicators (MFA-method changes, password resets, new device registration, outbound lateral phishing, evasive inbox-rule creation) to minimize detection surface while the actor harvests information. In a smaller set of hands-on-keyboard intrusions, the actor does take direct action: creating inbox rules that move messages containing "direct deposit" or "bank" keywords to Deleted Items or Conversation History and mark them read (hiding HR correspondence about fraudulent payroll-change requests from the victim), and in limited cases changing the account password or MFA methods to entrench persistence. This interactive activity originates from a distinct hosting-provider ASN (AS27176, Datawagon LLC) rather than the residential-proxy ranges used for routine token refresh. Storm-2755's documented endgame is direct financial theft: sending an email such as "Question about direct deposit" while impersonating the compromised employee, then socially engineering HR staff into manually changing direct-deposit details, or directly manipulating HR SaaS platforms (e.g., Workday) to redirect the victim's salary to an attacker-controlled bank account.

Targeting spans healthcare, education, manufacturing, government, and professional-services organizations across the United States, Canada, and Europe, with hundreds of organizations affected as of Arctic Wolf's August 2026 reporting.