Payroll Pirate AiTM M365 Token Replay via Firefox 131.0 to Microsoft Graph

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects anomalous, non-interactive Microsoft Graph sign-in activity consistent with the Payroll Pirate session hijacking campaign. The rule flags instances where the same user account authenticates via Microsoft Graph using the 'Firefox/131.0' user agent from multiple distinct source IP addresses within a 6-hour window, indicating potential stolen session token replay from distributed proxy infrastructure.