Storm-2755 Payroll Pirates Anomalous MailItemsAccessed Activity

Lacey Cochrane@NullVectorX

•updated Aug 9, 2026•31•0•32

Detects anomalous mailbox access via the MailItemsAccessed operation, specifically identifying the unique ClientAppId and API pairing associated with the Storm-2755 (Payroll Pirates) adversary campaign. This activity indicates unauthorized access to email content, typically targeting high-value personnel such as payroll, finance, and HR staff through Adversary-in-the-Middle (AiTM) techniques.