Executive Summary
Microsoft Incident Response has identified a financially motivated campaign, tracked as ConsentFix, conducted by threat actor Storm-2755. This campaign specifically targets Canadian employees across various sectors by using malvertising and SEO poisoning to lure victims to a fraudulent Microsoft 365 login page (bluegraintours[.]com). Once credentials and session tokens are captured via Adversary-in-the-Middle (AiTM) techniques, the actor bypasses multi-factor authentication (MFA) to access HR and payroll systems.
The attack chain involves the use of the Axios HTTP client (version 1.7.9) to replay stolen tokens and maintain persistence. Once inside, the actor creates mailbox rules to hide communications from HR/Finance departments while requesting changes to direct deposit information. This activity has resulted in successful financial theft by redirecting salary payments to attacker-controlled accounts.
This campaign highlights the limitations of traditional MFA and emphasizes the need for phishing-resistant authentication. Storm-2755's focus on geographic targeting rather than specific industry verticals suggests a broad threat to any Canadian organization utilizing cloud-based HR and email services.