Executive Summary
The 'Payroll Pirates' campaign, primarily attributed to threat actor Storm-2755 with overlaps in Storm-2657, is actively targeting organizations across North America and Europe. The threat actors utilize sophisticated Adversary-in-the-Middle (AiTM) phishing techniques to bypass multi-factor authentication (MFA) by proxying genuine Microsoft 365 login sessions in real-time.
Technically, the attack begins with voicemail-themed lures that lead victims through a multi-stage redirect chain involving Google and Amazon S3 infrastructure. Once a session is hijacked, the actors perform automated reconnaissance via the Microsoft Graph API to identify finance and HR staff. The ultimate goal is financial fraud through the unauthorized modification of payroll bank details, achieved either via social engineering or direct HR platform access.
This campaign is highly effective because it operates entirely within the identity cloud, leaving no footprint on physical endpoints for EDR tools to detect. Sectors affected include healthcare, education, manufacturing, government, and professional services.