# Payroll Pirates (Storm-2755) Abuse Microsoft Graph for HR/Finance Staff Recon After AiTM Account Compromise

> A widespread, financially-motivated campaign overlapping with Microsoft's Storm-2755 ("Payroll Pirates") activity cluster uses voicemail-themed and SEO-poisoned lures to route Microsoft 365 users through legitimate-service redirect chains into adversary-in-the-middle (AiTM) proxy pages that capture session cookies and OAuth tokens, defeating non-phishing-resistant MFA. Compromised sessions are then used to query Microsoft Graph and enumerate payroll, HR, finance, and administrative staff, collect related financial email, and in some cases redirect employee direct-deposit payments to attacker-controlled accounts.

- **Published:** 2026-08-10T00:00:00Z
- **Last reviewed:** 2026-10-06T13:46:34.149Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1970
- **ID:** TL-2026-1970
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** Storm-2755
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Arctic Wolf researchers are tracking a widespread, active Microsoft 365 account-compromise campaign that shares significant tactical overlap with the "Payroll Pirates" activity cluster Microsoft tracks as Storm-2755, first documented publicly by Microsoft's Security Blog on 2026-04-09 against Canadian organizations and now observed more broadly across the U.S., Canada, and Europe.

Victims receive voicemail-themed phishing emails styled as automated call notifications with Microsoft branding and an "OPEN [Organization] VOICEMAIL PORTAL" call to action, with subject lines following the pattern '[Organization] :ATTN: Review messages. Ref id: [random string]'. Clicking the link routes the victim through a multi-stage redirect chain built entirely from abused legitimate infrastructure: a Google Meet link-redirect URL, Google's outbound-link infrastructure, a Google Ads Campaign Manager /ddm/clk dynamic click tracker, and an Amazon S3-hosted landing page, before finally reaching an attacker-registered adversary-in-the-middle (AiTM) domain. Separately, Microsoft's Storm-2755 reporting describes SEO poisoning and malvertising that ranked the actor-controlled domain bluegraintours[.]com at the top of search results for queries like "Office 365" and common misspellings such as "Office 265", driving victims directly to a spoofed Microsoft 365 sign-in page.

The AiTM infrastructure is newly registered (domains observed less than 10 days old at time of use) and hosted on Hostinger, serving over HTTP/2 with response headers 'server: openresty/1.31.1.1' and 'x-powered-by: Express' at the root, and 'x-powered-by: PHP/8.2.32' on a fingerprinting endpoint at path '/st_58200519/class_identifier.php'. That endpoint collects a browser/device fingerprint (navigator properties, screen dimensions, language, timezone, WebGL vendor/renderer, cookie support) and queries api.country.is for geolocation, storing the result in a 7-day 'rcfh_country' cookie, before serving a reverse-proxied copy of the genuine Microsoft authentication flow. Because the kit proxies the real Microsoft login in real time rather than presenting a static credential-harvesting page, it captures session cookies and OAuth access/refresh tokens as the victim completes an otherwise normal sign-in, including MFA — rendering non-phishing-resistant MFA insufficient. A missing OAuth nonce parameter in the AiTM-initiated flow produces the rare Microsoft Entra sign-in error 90014, and Entra error 50199 has been observed immediately preceding successful token replay; both are high-fidelity indicators when paired with residential-proxy source traffic. Microsoft's Storm-2755 reporting separately documents an Axios/1.7.9 HTTP client used to replay stolen tokens roughly every 30 minutes, keeping sessions alive for up to approximately 30 days until refresh-token expiration.

Post-compromise sign-in activity shows a distinctive pattern: an initial burst of sign-ins from multiple residential-proxy IP addresses within seconds of compromise, often reporting implausible OS/browser combinations (e.g., Mobile Safari reported on Windows 10); recurring "maintenance" sign-ins roughly every 8 hours (11-24 hours after the initial burst) from rotating residential-proxy addresses commonly associated with an "anyIP"-style network; and a single Entra SessionID persisting unchanged across many different source IP addresses, ASNs, and geographic locations. The client consistently claims to be Microsoft Outlook while the actual user-agent string is anomalous — Firefox 131.0, Firefox 151.0, or Python Requests — rather than a genuine Outlook/Edge client.

Once inside a tenant, the actor queries Microsoft Graph (GET https://graph.microsoft.com/v1.0/users with role/department filters for payroll, HR, finance, and administrative terms; GET https://graph.microsoft.com/v1.0/users?$top=999 for broad enumeration; and GET https://graph.microsoft.com/v1.0/me) using the user-agent 'axios/1.18.1', triggering the Microsoft Defender XDR alert "Suspicious Exchange Online Graph Reconnaissance Activity." The actor then reads mailbox content via MailItemsAccessed "Bind" operations (ClientAppId 5d661950-3475-41cd-a2c3-d671a3162bc1 claiming Microsoft Outlook, undocumented APIId c999ed3e-27ae-4cb3-b3a2-46b056af63d3, user-agent 'Client=REST;Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0'), searching for messages containing payroll, invoices, payments, banking, benefits, and internal-documentation keywords. This collection is tightly synchronized across tenants — Arctic Wolf observed 18 MailItemsAccessed events across 3 different tenants within 26 seconds, and 11 events across 2 tenants within 43 seconds — indicating centralized, automated orchestration rather than manual, per-victim browsing.

Most intrusions deliberately avoid classic business-email-compromise indicators (MFA-method changes, password resets, new device registration, outbound lateral phishing, evasive inbox-rule creation) to minimize detection surface while the actor harvests information. In a smaller set of hands-on-keyboard intrusions, the actor does take direct action: creating inbox rules that move messages containing "direct deposit" or "bank" keywords to Deleted Items or Conversation History and mark them read (hiding HR correspondence about fraudulent payroll-change requests from the victim), and in limited cases changing the account password or MFA methods to entrench persistence. This interactive activity originates from a distinct hosting-provider ASN (AS27176, Datawagon LLC) rather than the residential-proxy ranges used for routine token refresh. Storm-2755's documented endgame is direct financial theft: sending an email such as "Question about direct deposit" while impersonating the compromised employee, then socially engineering HR staff into manually changing direct-deposit details, or directly manipulating HR SaaS platforms (e.g., Workday) to redirect the victim's salary to an attacker-controlled bank account.

Targeting spans healthcare, education, manufacturing, government, and professional-services organizations across the United States, Canada, and Europe, with hundreds of organizations affected as of Arctic Wolf's August 2026 reporting.

## MITRE ATT&CK

- T1608.006 Stage Capabilities: SEO Poisoning
- T1583.001 Acquire Infrastructure: Domains
- T1583.008 Acquire Infrastructure: Malvertising
- T1566.002 Phishing: Spearphishing Link
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1078.004 Valid Accounts: Cloud Accounts
- T1556.006 Modify Authentication Process: Multi-Factor Authentication
- T1087.003 Account Discovery: Email Account
- T1087.004 Account Discovery: Cloud Account
- T1114.002 Email Collection: Remote Email Collection
- T1564.008 Hide Artifacts: Email Hiding Rules
- T1090.002 Proxy: External Proxy
- T1657 Financial Theft
- T1111 Multi-Factor Authentication Interception
- T1550.004 Use Alternate Authentication Material: Web Session Cookie

## Sources

- [Payroll Pirates Abuse Microsoft Graph to Find HR and Finance Staff After Account Compromise](https://gbhackers.com/payroll-pirates-abuse-microsoft-graph/)
- [Payroll Pirates: Strange New Tides in Business Email Compromise](https://arcticwolf.com/resources/blog/payroll-pirates-strange-new-tides-in-business-email-compromise/)
- [Investigating Storm-2755: "Payroll pirate" attacks targeting Canadian employees](https://www.microsoft.com/en-us/security/blog/2026/04/09/investigating-storm-2755-payroll-pirate-attacks-targeting-canadian-employees/)
- [Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails](https://thehackernews.com/2026/08/microsoft-365-aitm-phishing-hijacks.html)
- [Standard MFA Won't Stop Hackers Who Route Microsoft 365 Phishing Through Google](https://www.techtimes.com/articles/323514/20260807/standard-mfa-wont-stop-hackers-who-route-microsoft-365-phishing-through-google.htm)
- [Payroll Pirates AiTM Campaign Hits Microsoft 365 Across Sectors](https://www.technadu.com/a-fake-voicemail-is-all-it-takes-new-aitm-campaign-bypasses-mfa-across-us-canadian-and-european-firms/632987/)
- [Storm-2755's Silent Payroll Heist Targeting Canada](https://www.hivepro.com/threat-advisory/storm-2755-silent-payroll-heist-targeting-canada)
- [The Payroll Pirate Campaign Leverages AiTM Session Hijacking to Target HR Departments](https://securityonline.info/payroll-pirate-campaign-aitm-hijacking/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1970