Storm-2755 - Inbox Rule Creation (Payroll Hiding)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•4•0•11

Detects the threat actor creating inbox rules to delete or archive emails containing keywords like "deposit", "payroll", "HR", "Workday", or "ADP" to hide their tampering, often associated with the Storm-2755 campaign.